One method to simplify the administration of access controls is to group

Not quite right..Objects and subjects cannot be ‘grouped’ together other than in an ACL only if we stretch the idea. Grouping them separately does simplify Access Control. Acc to Microsoft: Some of the goals of role-based access control can be accomplished using groups. A group corresponds to an employee role, and application administrators can specify the permissions that are needed by the role by granting the group permission in a DACL for the object.
For full article here:
http://technet.microsoft.com/en-us/library/cc780256%28v=WS.10%29.aspx