Currently only groups. The goal is to eventually expand the permission set so you can apply all permissions to an individual user.