Delegate,Delegate,Delegate

Note to self, always add the group you want to assign rights to to the user group you want to assign rights from in the Portal config.

<?xml version="1.0" encoding="UTF-8"?>
<request type="update" version="8.0.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="PortalConfig_8.0.0.xsd" create-oids="true">
    <portal action="locate">
        <group action="update" domain="rel" name="baseline_group">
            <access-control externalized="false" owner="undefined" private="false">
                <role actionset="Delegator" update="set">
                    <mapping subjectid="portal_editors" subjecttype="user_group" update="set" />
                    <mapping subjectid="librarians" subjecttype="user_group" update="set" />
/>
                </role>
                <role actionset="Can Run As User" update="set">
                    <mapping subjectid="librarians" subjecttype="user_group" update="set" />
/>
                </role>
            </access-control>
        </group>
    </portal>
</request>