The main problem is that ACS chose to use a hierarchical model for objects. Once a bad choice is made, you are stuck with it for eternity. It all sounds great, modeling objects like in an oo language, but every subtype then requires an additional join, and you can't add new functionality to every object, something added to a subtype is unavailable to parent types.
But this code (user/group/relations/permissions/etc.) is a huge can of worms. It isn't necessarily bad code, but it is much more difficult to understand than it seems like it should be. It is also very difficult to use it.
I did an experiment with this code about four years ago. I think you can add groups to other groups, but not via a web interface. Maybe that have changed, but the problem that I found is that you have to create a relational segment or a new rel type to do the mapping.
The example code is here:
http://rmadilo.com/files/unicycle/sql/postgresql/unicyclist-create.sql
The code adds a unicycle club (group) to a unicyclist group.
I just noticed there was some interesting code in the drop script which helps drop an entire package. This was easy because it only dropped users and objects created via the package, but it illustrates the method to really nuke packages, at least during development.
Code is in here:
http://rmadilo.com/files/unicycle/sql/postgresql/unicyclist-drop.sql
