Currently, the code which manages the global groups' permissions is coupled with special page for managing them, SpecialGlobalGroupPermissions. As part of the refactoring in the parent task, I'd like to move that service-like code to GlobalGroupLookup (which will thus become GlobalGroupManager).
Moving the code and making it a proper service will then make it easier to implement the further refactoring, by ensuring that manipulating the group properties will be done in a single class, so that any additional operations (like cache invalidation) can be coded there.