Gitlab is terrible at cross-group permissions if you use dedicated or self-hosted. Because gitlab.com is made to keep top level groups separate (separate tenants). Things like cross-group MR approval, use of the built-in artifact repositories, terraform module registry, gitlab components, and so on...is very messy...so many granular cross-group allows you have to turn on.