The crucial part of restricted global groups mechanism (similar to $wgRestrictedGroups for local groups) will be the code for checking the conditions when granting the group membership.

We will need to build support for:

• defining the group conditions, in a similar manner to $wgRestrictedGroups;
• checking user agaist the conditions, when someone attempts to grant them a restricted group;
• support restricted groups on Special:GlobalUserRights: disable disallowed groups, add annotations about restrictions, and adjust validation.

Acceptance criteria

• Global groups can have conditions defined
• Users cannot be added to groups they don't meet conditions for

Non-goals of this task:

• Disabling or demoting existing ineligible members of restricted global groups. This will be done separately, for now they can still retain membership and use their rights.