I am working in a Symfony 2.8 project and I have a doubt regarding users/groups/roles|permissions. There are a few ways to handle users and groups as for example SonataUser
It depends how you want to implement this.
One approach:
Implement the UserProviderInterface to loadByUsername (this is where you load the roles and permissions) an implementation of a UserInterface (your User).
Then Implement the VoterInterface. Register this as a service tagged with security.voter and specify it as a provider in security.yml. Override the vote function to assess the User you loaded for permissions (and maybe roles too) from TokenInterface which is the first argument of that function.