diff --git a/README.md b/README.md
index e1f118a..56e4f8e 100644
--- a/README.md
+++ b/README.md
@@ -178,11 +178,15 @@ Records a **single student attempt** at a resource. This is the primary data sou
 
 ### Groups (`security/groups.xml`)
 
-| Group | XML ID | Description |
-|-------|--------|-------------|
-| Student | `group_aps_student` | View assigned resources, submit attempts, view own dashboard |
-| Teacher | `group_aps_teacher` | Manage resources, grade submissions, view all dashboards |
-| Manager | `group_aps_manager` | Full admin access (implies Teacher) |
+All three groups belong to the **APEX** category (`module_category_aps`). Because they share the same category and form a linear implied-group chain, Odoo renders them as a **single selection dropdown** on the user permissions form instead of individual checkboxes.
+
+| Group | XML ID | Implies | Description |
+|-------|--------|---------|-------------|
+| Student | `group_aps_student` | — | View assigned resources, submit attempts, view own dashboard |
+| Teacher | `group_aps_teacher` | Student | Manage resources, grade submissions, view all dashboards |
+| Manager | `group_aps_manager` | Teacher (→ Student) | Full administrative access to all APEX features |
+
+Permissions are **inherited**: a Manager has all Teacher permissions, and a Teacher has all Student permissions.
 
 ### ACL rules (`security/ir.model.access.csv`)
 
diff --git a/security/groups.xml b/security/groups.xml
index 1728474..da16786 100644
--- a/security/groups.xml
+++ b/security/groups.xml
@@ -9,23 +9,31 @@
             <field name="sequence">20</field>
         </record>
 
-        <!-- APS SIS Security Groups (hierarchy: Student → Teacher → Manager) -->
+        <!-- APS SIS Security Groups (hierarchy: Student → Teacher → Manager)
+             All groups share module_category_aps so Odoo renders them as a
+             single selection dropdown on the user form instead of checkboxes.
+             implied_ids creates the inheritance chain so that a Teacher also
+             has all Student permissions, and a Manager also has all Teacher
+             (and Student) permissions. -->
         <record id="group_aps_student" model="res.groups">
             <field name="name">Student</field>
             <field name="category_id" ref="module_category_aps"/>
+            <field name="sequence">10</field>
             <field name="comment">Students can view their assigned resources and submit attempts</field>
         </record>
 
         <record id="group_aps_teacher" model="res.groups">
             <field name="name">Teacher</field>
             <field name="category_id" ref="module_category_aps"/>
-            <!-- <field name="implied_ids" eval="[(4, ref('group_aps_student'))]"/> -->
+            <field name="sequence">20</field>
+            <field name="implied_ids" eval="[(4, ref('group_aps_student'))]"/>
             <field name="comment">Teachers can manage resources, tasks, and view student progress</field>
         </record>
 
         <record id="group_aps_manager" model="res.groups">
             <field name="name">Manager</field>
             <field name="category_id" ref="module_category_aps"/>
+            <field name="sequence">30</field>
             <field name="implied_ids" eval="[(4, ref('group_aps_teacher'))]"/>
             <field name="comment">Full administrative access to all APEX features</field>
         </record>