Authorization Group for I-Base

Hi Gurus,

I am confused between authorization object & authorization group for Installed base.

As far as my knowledge concern, Authorization object of I-base (crm_ibase) is assigned and controlled by PFCG.

And Authorization Group is firstly define and assign it to I-base general data.

My question is, If i assign Authorization group in I-Base, whereas i need to assign it    SU01 0r ?????

and what will be the use of it.