Hmmm...was searching for something else in the docos and read this little extract:

Resources can be assigned to users only. They cannot be assigned to groups or containers. However, if a role is assigned to a group or container, the users in that group or container might automatically be granted access to the resources associated with the role.

So, by that wording group/container assignments sometimes work, sometimes don't... Flip a coin. Cross your fingers. Hope for the best.