!%user means that they can_target NOT(!) group(%) user. Meaning they can't inherit any groups that inherit_from user, which is pretty much every group.
If you want the group to target everyone, then you can just put a * there or leave it blank, like the superadmin can_target default should be.
If you want to target a single group... uhh.. you actually can't, due to limitations of the targeting engine. Me and Megiddo are discussing this right now though,
we may have a way to implement it without breaking too much stuff The best way to set up your permissions is to line them up in order of most access to least access, making the higher ones inherit from the next lowest: management inherits from headadmin, headadmin inherits from superadmin, superadmin inherits from admin, etc..
From there, the can_target for each group would be !%thegroupabove, so user would be !%vip, vip would be !%operator, operator would be !%donator, etc., depending on your order of groups.