The issue was with my replication script which was passing drop as @pre_creation_cmd in sp_addarticle.
So, when the table was dropped all the permissions was dropped as well.
Once I changed it to delete it fixed the issue.
here you can find what happens when you reinizialize a subscription:
What happens to permissions ...
you can use GRANT ... WITH GRANT OPTION.
this option specifies that the security principal receiving the permission is given the ability to grant the specified permission to other security accounts.
A sketch for an alternative approach would be:
-- supertype for user / group, it is not clear from your post what
-- an appropriate name would be, so I'll just use `x`. each x is of a
-- certain type.
CREATE TABLE x_types
( x_type CHAR(1) NOT NULL PRIMARY KEY
, -- maybe add a description
INSERT INTO x_types (x_type) VALUES ('u'), ('g');