SQL integrated security permissions

I have SQL permissions specified as follows:

Database 1:

Group 1:

sysadmin (role)

Group 2:

db_owner

public

Group 3:

db_datareader

public

Group 2 does not have the ability to modify the RDM database. Group 1 does. If Group 2 is added to the sysadmin role the users can make changes to the RDM database.

Are there any other system databases and/or permissions that the users should have to allow changes to the RDM database(s)?

Thanks!