In Self services > Requests, a person for whom an identity has been created with role Self-Service User can request group memberships, that grant access privileges. Notification e-mails are sent to requester and approvers.