Add optional user/group on all entities

[arruda]

This would be a simpler first step to getting multiple groups permission