The default ACL for groups in any domain is specified in the ics.conf file parameter group.default.acl. The default ACL is:
"@@o^a^r^g;@@o^c^wdeic^g;@^a^rsf^g"
You can change the ACL by editing it.