Manual:$wgAddGroups

Details
If a group can add any right (example: bureaucrats can add any right): If a group can add only some rights (example: bureaucrats can add only sysop and bot groups):

Note that groups which may only grant some rights (like bureaucrats in this example) need to have set userrights privilege to false, otherwise they will still be able to add all groups (except in 1.11).