Architecture and example code to achieve dynamic user, group, permissions in AWS Amplify + appsync (reactjs,graphQL)

I am new to AWS and currently experimenting with AWS Amplify trying to build a web based project using reactjs which could cover few aws services(dynamoDB, Cognito, appsync using graphQL).

I would like to have user, groups, permissions for the users as shown in the image.

The above screenshot is from a popular opensource EDMS solution for reference.

I specifically want the ability of creating different groups and dynamically assigning users and permissions to the groups through the project UI itself, not through the AWS console.

I am unable to figure out how should I design the schema.graphql which would work for the above requirement. Also not sure if I need to configure any of AWS services differently to make this work.

Thanks!