Currently the "CiviCRM Shortcuts" block shows "New Group" even if the user does not have 'Edit Groups' permission. This item in the shortcuts block should be suppressed in this case.
NOTE: The code currently suppresses the ENTIRE Shortcuts block when the user doesn't have 'add contacts' permission. This is correct behavior - but we need to make sure the control is 'granular' to the block element level. So if a user has 'edit groups', but NOT 'add contacts' - the block would only include the New Group link.