alternative permissions model with repoze.what
I have an answer, after a bit of fiddling. 
The answer is that the only reason to use the authentication schema suggested in the repoze.what documentation is that if you do, you can use their predicates for free. Fortunately, writing & using your own predicates is a piece of cake. It seems to me that the only hard requirement is for a user object (although obviously you can call this whatever you want). In my app I have a bunch of custom predicates that check certain things like:

Is the user a member of this group? (group specified by a parameter)
Is the user logged in?
Does the user hold this particular site role?

I can then use these predicates wherever I want.
I'm writing a web app, and I'd like to use repoze.what & repoze.who to handle my authorisation & authentication. The problem is that repoze.what seems to be hard-coded to accept a certain permissions model, that is:

Visitors to the site are either a logged in user, or anonymous.
User accounts belong to 0 or more groups.
Groups have 0 or more permissions associated with them.

So, for example, your permissions might be 'can-post-article' and 'can-post-comment', and your groups might be 'author', 'visitor', where 'author' can both post articles & post comments, while visitors can only post comments.
That model probably works for most sites. However, my site allows teams to collaborate with each other on different levels. So the security model that I need is:

Visitors are either a logged in user, or anonymous.
Users are a member of 0 or more groups.
For each group that the user is a member of, that membership will have different permissions. For example, the user might be an 'author' or group A, but a 'commenter' on group B.

The number of groups will change over time, and the memberships of those groups will also change. I can't see any easy way to integrate this permissions model into repoze.what. Am I missing something obvious?