When people typically handle entity security, do you nest the parents security group in its children security group?

I think it mostly depends on sheer number of users and howmany different types of access. I have always preferred to divide security up in Role groups, then individual entity/wf access then two of everything to handle read and write