one of the documented procedures in this installation of the ACS
ad_user_group_user_add   db   user_id   role   group_id
What it does:
Maps the specified user to the specified group in the specified role; if the mapping already exists, does nothing.
Defined in: /web/philip/packages/acs-core/user-groups-procs.tcl

Source code:

    if [catch {
    ns_db dml $db "insert into user_group_map(user_id, group_id, role, mapping_user, mapping_ip_address)
values ($user_id, $group_id, '[DoubleApos $role]',[ad_get_user_id],'[DoubleApos [peeraddr]]')" } errmsg] {

    # if the insert failed for a reason other than the fact that the
    # mapping already exists, then raise the error
    if {
	[database_to_tcl_string $db "select count(*) from
	where user_id = $user_id and group_id = $group_id and role = '[DoubleApos $role]'"] == 0
    } {
	error $errmsg

    return 1