Well, maybe not group membership, but certainly there is a 'root' to the tree of permissions and capabilities, and I think it's true that some of them derive from more basic capabilities.

If each capability (cross the namespace or object to which it is applied, for non-global capabilities) is a leaf, then the global capability itself is a branch from which all of those leaves have sprouted, and the set of all capabilities live in a tree...

There is Root at the base of the trunk uniting all of the branches.