Create a ProgramGroup model. This model will have a foreign key field to a Program and a role field, similar to OrganizationGroup.
We can refactor the roles to make them more generic. For now, it is acceptable to have general read and write roles and not to segment roles across different resources. A read role, for example, should give read access to everything.