users->relation->groups,
user->relation->groups,
users->relation->permissions and
user->relation->permissions
(And if possible even using a filter:)
user->relation->permissions->(name EQ 'Can add photo')