The privilege subject defines whom a privilege is granted to i.e. which users the permission contained in the privilege is granted to. The privilege subject can be a either a specific user or a specific user group.

If the privilege subject is a user group the users who have this privilege are evaluated when the privilege is queried by the system. I.e. by changing the members of a user group the effective privileges for the users might change. Note that group membership is propagated upward in the user group tree. Therefore if a user is member of a subgroup and a certain permission is granted to parent group, user gains this permission as well. E.g. if group B is subgroup of group A and user C belongs to group B, all privileges where the privilege subject is group A will result in permissions for user C.

Using user groups as privilege subjects is advisable since it allows you to easily grant the same permissions to groups of users with minimal configuration work and allows consistent changes of permissions.