Example: all my members even admin have a common primary usergroup who can't perform an action of an addon, but admins (secondary group) can do it. If I dump the $visitor variable the combination between permissions didn't work. The permissions for addons are only those set for Primary Usergroups.
See posts about the Taigachat:
2-click (last quote)