...
A Need Exposed
The introduction of the JA-SIG Aggregated Layout Management feature makes reuse of the GroupsManager channel to define who receives pushed fragments or who can subscribe to pulled fragments. Although it appears to use the same assignment paradygm in the screen it varies significantly from the grant model used by Channel Manager. Namely, the new ALM functionality did not make use of the existing permissions infrastructure.
...
This means that when fragment publishing is enhanced to use permissions correctly and fragment publishing is granted to a user along with channel publishing there is no way to distinguish different sets of user to whom they can publish channels versus those to whom they can publish fragments.
A suggestion for enhancment of grant restrictions has been outlined here: Grant Restriction Enhancements