AGDLP
AGDLP ( an abbreviation of "account , global , domain local , permission" ) briefly summarizes Microsoft's recommendations for implementing role-based access controls ( RBAC ) using nested groups in a native-mode Active Directory ( AD ) domain: User and computer accounts are members of global groups that represent business roles , which are members of domain local groups that describe resource permissions or user rights assignments . 
<triplet> Active Directory <subj> Microsoft <obj> developer