This is an actual work-related problem.  Users could previously su - userx and was able to execute a script with user:owner permissions as userx:groupz 760 or 540, or modify a file that's userx:groupz 740 or 640.  Now, that user may no longer su to userx and must perform tasks as a member of groupz.  The group permissions need to be changed, but the problem files must be found first.  They can be found when they fail, or hopefully you could help me find them proactively.  Any file or directory whose owner:group is userx:groupz and whose group permissions are more restrictive than the owner permissions might be a problem and must be looked at in the context of business logic.  Is there a way to find all such files and directories?  An answer to this could uncover many potential problems that would otherwise only surface when an operation that used to work now fails.
Find files with group permissions more restrictive than owner permissions
files;permissions;find