If a user is a member of a group, IRM Server also checks the privilege setting defined for the group.
If the group has the privilege granted, regardless of the library-level setting, the user is allowed to perform the function.
If the group has the privilege revoked, regardless of the library-level setting, the user is not allowed to perform the function.