one of the documented procedures in this installation of the ACS
ad_user_group_action_role_map   db   group_id   action   role
What it does:
Maps an action to a role a user group.
Defined in: /web/philip/packages/acs-core/user-groups-procs.tcl

Source code:

    ns_db dml $db "insert into user_group_action_role_map (group_id, role, action, creation_user, creation_ip_address) select $group_id, '[DoubleApos $role]', '[DoubleApos $action]', [ad_get_user_id], '[DoubleApos [peeraddr]]' from dual where not exists (select role from user_group_action_role_map where group_id = $group_id and role = '[DoubleApos $role]' and action = '[DoubleApos $action]')"