In a well designed system:
- Users should be assigned to Groups
- Groups should have assigned Permissions
This allows separation of concerns. It would not be smart to set up the system to allow arbitrary permissions when adding users.
From a UX perspective, this simplifies things too. You can use checkboxes or multi-select fields to assign a User to multiple Groups.
Here's an example of a school:
- View Enrollment (All)
- View School Fee Balances (Accountants, Parents)
- Enter Test Scores & Results (Professors)
- View Test Results (Professors, Parents, Students)
If you had a user Sam that was a Parent of one of the students and a Professor at the school - it would be easier to add Sam to the respective groups instead of trying to figure out which individual permissions to assign her.
You're operating in the area of Role-Based Access Control (RBAC) Having worked on type of UI, I can attest that is not a trivial design problem. There's perhaps more thinking and design involved that might be reasonable to offer for free on short notice on a site like this. (Though I would genuinely love to be proved wrong on that.)
Google image searching around the area 'rbac ui' 'rbac groups ui' will find some examples of this type of UI.
Research apps that offer RBAC. My go to in this situation would be Google Analytics, though I could probably drum up other with an email to my IT department. Be inspired by other versions of what you're trying to achieve.
You're basically looking at some tables that offer views of different groups, that communicates and enables their connectedness.