One thing we learned the slow way: the group key can’t be changed after you create it. The key is what shows in the audit log and in policy conditions, so we went with plant.north.operators style keys and kept the friendly names in the label.