zammad/app/policies/controllers/groups_controller_policy.rb

class Controllers::GroupsControllerPolicy < Controllers::ApplicationControllerPolicy
  default_permit!('admin.group')
end