[MERGE] orm: model-level @groups attribute for access control, part 1