Currently, globalgroupmembership is equivalent to userrights in that holders can edit all global user membership. I suggest creating the equivalent of $wgAddGroups and $wgRemoveGroups but for global groups. Should this be done in config (as currently done for these settings) or onwiki as part of managing groups via Special:GlobalGroupPermissions (i.e. add an option that a global group can add/remove specific other groups)? I don't image that the settings would need to be edited frequently, so using php config should work, but given that the rest of global group management is stored in the database after on-wiki changes it may make sense to do the same for this.

Change 737008 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/CentralAuth@master] Add limited editing for global group membership

https://gerrit.wikimedia.org/r/737008