Permissions are currently assigned to a user or group with a given name. While form validation gives the impression to match that to a user or group, either will be granted the permission.

It should be possible to grant permissions explicitly to a user or a group, not either.