Not all_groups, since that would expose groups the user does not have access to
Attach a file by drag & drop or click to upload
