The group permission based option makes sense and is also characteristic of how Debian usualy deals with these issues.