Primary and secondary groups

All groups are active at all times.

You can access any file that any of your groups can access. But when you create a new file/process it is created using your primary group, unless setgid or ACL defaults are in use.

Essentially, it's part of a strategy to mitigate some security concerns while allowing users a simple way to collaborate with less permission hassles.

Linux systems have what's called a umask, which dictates file and directory permissions assigned on creation. By default, this umask is usually 022 which creates files with 644 permissions (owner read/write, group read-only, other read-only) and creates the restrictive settings normally applied to new files and directories.

Unfortunately, the lack of read/write for the group means that you have to rely on the person who created the file to grant proper permissions for a group to edit it (and users are not always reliable regarding this).

Part of the way to help solve this is to set a umask of 002 which results in files with 664 permissions (owner read/write, group read/write, other read-only). But this could have unwanted side effects (e.g. team members could edit each others private files dependent on default groups). So each each new user becomes part of a default group with just one user (emulating the 022/644 scheme).

More on how this helps collaboration: https://security.ias.edu/how-and-why-user-private-groups-unix