diff --git a/src/main/java/com/google/devtools/build/lib/analysis/BUILD b/src/main/java/com/google/devtools/build/lib/analysis/BUILD
index bc5842d291068e..30510adab44cbd 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/BUILD
+++ b/src/main/java/com/google/devtools/build/lib/analysis/BUILD
@@ -324,6 +324,7 @@ java_library(
         ":dependency_key",
         ":dependency_kind",
         ":duplicate_exception",
+        ":exec_group_collection",
         ":extra/extra_action_info_file_write_action",
         ":extra_action_artifacts_provider",
         ":file_provider",
@@ -418,7 +419,6 @@ java_library(
         "//src/main/java/com/google/devtools/build/lib/skyframe:configured_value_creation_exception",
         "//src/main/java/com/google/devtools/build/lib/skyframe:package_value",
         "//src/main/java/com/google/devtools/build/lib/skyframe:precomputed_value",
-        "//src/main/java/com/google/devtools/build/lib/skyframe:sane_analysis_exception",
         "//src/main/java/com/google/devtools/build/lib/skyframe:toolchain_context_key",
         "//src/main/java/com/google/devtools/build/lib/skyframe:transitive_target_key",
         "//src/main/java/com/google/devtools/build/lib/skyframe:transitive_target_value",
@@ -758,6 +758,23 @@ java_library(
     srcs = ["DuplicateException.java"],
 )
 
+java_library(
+    name = "exec_group_collection",
+    srcs = ["ExecGroupCollection.java"],
+    deps = [
+        ":resolved_toolchain_context",
+        ":toolchain_collection",
+        "//src/main/java/com/google/devtools/build/lib/analysis/platform",
+        "//src/main/java/com/google/devtools/build/lib/packages:exec_group",
+        "//src/main/java/com/google/devtools/build/lib/skyframe:sane_analysis_exception",
+        "//src/main/java/com/google/devtools/build/lib/util:detailed_exit_code",
+        "//src/main/protobuf:failure_details_java_proto",
+        "//third_party:auto_value",
+        "//third_party:guava",
+        "//third_party:jsr305",
+    ],
+)
+
 java_library(
     name = "extra_action_artifacts_provider",
     srcs = ["ExtraActionArtifactsProvider.java"],
diff --git a/src/main/java/com/google/devtools/build/lib/analysis/ConfiguredTargetFactory.java b/src/main/java/com/google/devtools/build/lib/analysis/ConfiguredTargetFactory.java
index 5ff697252db34b..ffec432bba5688 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/ConfiguredTargetFactory.java
+++ b/src/main/java/com/google/devtools/build/lib/analysis/ConfiguredTargetFactory.java
@@ -25,7 +25,7 @@
 import com.google.devtools.build.lib.actions.ArtifactFactory;
 import com.google.devtools.build.lib.actions.FailAction;
 import com.google.devtools.build.lib.actions.MutableActionGraph.ActionConflictException;
-import com.google.devtools.build.lib.analysis.RuleContext.InvalidExecGroupException;
+import com.google.devtools.build.lib.analysis.ExecGroupCollection.InvalidExecGroupException;
 import com.google.devtools.build.lib.analysis.config.BuildConfiguration;
 import com.google.devtools.build.lib.analysis.config.ConfigMatchingProvider;
 import com.google.devtools.build.lib.analysis.config.Fragment;
@@ -186,7 +186,8 @@ public final ConfiguredTarget createConfiguredTarget(
       ConfiguredTargetKey configuredTargetKey,
       OrderedSetMultimap<DependencyKind, ConfiguredTargetAndData> prerequisiteMap,
       ImmutableMap<Label, ConfigMatchingProvider> configConditions,
-      @Nullable ToolchainCollection<ResolvedToolchainContext> toolchainContexts)
+      @Nullable ToolchainCollection<ResolvedToolchainContext> toolchainContexts,
+      ExecGroupCollection.Builder execGroupCollectionBuilder)
       throws InterruptedException, ActionConflictException, InvalidExecGroupException {
     if (target instanceof Rule) {
       try {
@@ -199,7 +200,8 @@ public final ConfiguredTarget createConfiguredTarget(
             configuredTargetKey,
             prerequisiteMap,
             configConditions,
-            toolchainContexts);
+            toolchainContexts,
+            execGroupCollectionBuilder);
       } finally {
         CurrentRuleTracker.endConfiguredTarget();
       }
@@ -292,7 +294,8 @@ private ConfiguredTarget createRule(
       ConfiguredTargetKey configuredTargetKey,
       OrderedSetMultimap<DependencyKind, ConfiguredTargetAndData> prerequisiteMap,
       ImmutableMap<Label, ConfigMatchingProvider> configConditions,
-      @Nullable ToolchainCollection<ResolvedToolchainContext> toolchainContexts)
+      @Nullable ToolchainCollection<ResolvedToolchainContext> toolchainContexts,
+      ExecGroupCollection.Builder execGroupCollectionBuilder)
       throws InterruptedException, ActionConflictException, InvalidExecGroupException {
     ConfigurationFragmentPolicy configurationFragmentPolicy =
         rule.getRuleClassObject().getConfigurationFragmentPolicy();
@@ -312,6 +315,7 @@ private ConfiguredTarget createRule(
             .setConfigConditions(configConditions)
             .setUniversalFragments(ruleClassProvider.getUniversalFragments())
             .setToolchainContexts(toolchainContexts)
+            .setExecGroupCollectionBuilder(execGroupCollectionBuilder)
             .setConstraintSemantics(ruleClassProvider.getConstraintSemantics())
             .setRequiredConfigFragments(
                 RequiredFragmentsUtil.getRequiredFragments(
@@ -527,6 +531,7 @@ public ConfiguredAspect createAspect(
             .setToolchainContext(toolchainContext)
             // TODO(b/161222568): Implement the exec_properties attr for aspects and read its value
             // here.
+            .setExecGroupCollectionBuilder(ExecGroupCollection.emptyBuilder())
             .setExecProperties(ImmutableMap.of())
             .setConstraintSemantics(ruleClassProvider.getConstraintSemantics())
             .setRequiredConfigFragments(
diff --git a/src/main/java/com/google/devtools/build/lib/analysis/ExecGroupCollection.java b/src/main/java/com/google/devtools/build/lib/analysis/ExecGroupCollection.java
new file mode 100644
index 00000000000000..1a42e456e08eba
--- /dev/null
+++ b/src/main/java/com/google/devtools/build/lib/analysis/ExecGroupCollection.java
@@ -0,0 +1,267 @@
+// Copyright 2021 The Bazel Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package com.google.devtools.build.lib.analysis;
+
+import static com.google.common.collect.ImmutableSet.toImmutableSet;
+import static com.google.devtools.build.lib.packages.ExecGroup.DEFAULT_EXEC_GROUP_NAME;
+import static java.util.stream.Collectors.joining;
+
+import com.google.auto.value.AutoValue;
+import com.google.common.collect.HashBasedTable;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableTable;
+import com.google.common.collect.Table;
+import com.google.devtools.build.lib.analysis.platform.PlatformInfo;
+import com.google.devtools.build.lib.packages.ExecGroup;
+import com.google.devtools.build.lib.server.FailureDetails.Analysis;
+import com.google.devtools.build.lib.server.FailureDetails.Analysis.Code;
+import com.google.devtools.build.lib.server.FailureDetails.FailureDetail;
+import com.google.devtools.build.lib.skyframe.SaneAnalysisException;
+import com.google.devtools.build.lib.util.DetailedExitCode;
+import java.util.Collection;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import javax.annotation.Nullable;
+
+/**
+ * A container class for groups of {@link ExecGroup} instances. This correctly handles exec group
+ * inheritance between rules and targets. See
+ * https://docs.bazel.build/versions/master/exec-groups.html for further details.
+ */
+@AutoValue
+public abstract class ExecGroupCollection {
+
+  public static Builder emptyBuilder() {
+    return new AutoValue_ExecGroupCollection_Builder(ImmutableMap.of());
+  }
+
+  public static Builder builder(
+      ExecGroup defaultExecGroup, ImmutableMap<String, ExecGroup> execGroups) {
+    // Post-process the groups to handle inheritance.
+    Map<String, ExecGroup> processedGroups = new LinkedHashMap<>();
+    for (Map.Entry<String, ExecGroup> entry : execGroups.entrySet()) {
+      String name = entry.getKey();
+      ExecGroup execGroup = entry.getValue();
+
+      if (execGroup.copyFrom() != null) {
+        if (execGroup.copyFrom().equals(DEFAULT_EXEC_GROUP_NAME)) {
+          execGroup = execGroup.inheritFrom(defaultExecGroup);
+        } else {
+          execGroup = execGroup.inheritFrom(execGroups.get(execGroup.copyFrom()));
+        }
+      }
+
+      processedGroups.put(name, execGroup);
+    }
+
+    return new AutoValue_ExecGroupCollection_Builder(ImmutableMap.copyOf(processedGroups));
+  }
+
+  /** Builder class for correctly constructing ExecGroupCollection instances. */
+  // Note that this is _not_ an actual @AutoValue.Builder: it provides more logic and has different
+  // fields.
+  @AutoValue
+  public abstract static class Builder {
+    public abstract ImmutableMap<String, ExecGroup> execGroups();
+
+    public ImmutableSet<String> getExecGroupNames() {
+      return execGroups().keySet();
+    }
+
+    public ExecGroup getExecGroup(String name) {
+      return execGroups().get(name);
+    }
+
+    public ExecGroupCollection build(
+        @Nullable ToolchainCollection<ResolvedToolchainContext> toolchainContexts,
+        ImmutableMap<String, String> rawExecProperties)
+        throws InvalidExecGroupException {
+
+      // For each exec group, compute the combined execution properties.
+      ImmutableTable<String, String, String> combinedExecProperties =
+          computeCombinedExecProperties(toolchainContexts, rawExecProperties);
+
+      return new AutoValue_ExecGroupCollection(execGroups(), combinedExecProperties);
+    }
+  }
+
+  /**
+   * Gets the combined exec properties of the platform and the target's exec properties. If a
+   * property is set in both, the target properties take precedence.
+   */
+  private static ImmutableTable<String, String, String> computeCombinedExecProperties(
+      @Nullable ToolchainCollection<ResolvedToolchainContext> toolchainContexts,
+      ImmutableMap<String, String> rawExecProperties)
+      throws InvalidExecGroupException {
+
+    ImmutableSet<String> execGroupNames;
+    if (toolchainContexts == null) {
+      execGroupNames = ImmutableSet.of(DEFAULT_EXEC_GROUP_NAME);
+    } else {
+      execGroupNames = toolchainContexts.getExecGroupNames();
+    }
+
+    // Parse the target-level exec properties.
+    ImmutableTable<String, String, String> parsedTargetProperties =
+        parseExecProperties(rawExecProperties);
+    // Validate the exec group names in the properties.
+    if (toolchainContexts != null) {
+      ImmutableSet<String> unknownTargetExecGroupNames =
+          parsedTargetProperties.rowKeySet().stream()
+              .filter(name -> !name.equals(DEFAULT_EXEC_GROUP_NAME))
+              .filter(name -> !execGroupNames.contains(name))
+              .collect(toImmutableSet());
+      if (!unknownTargetExecGroupNames.isEmpty()) {
+        throw new InvalidExecGroupException(unknownTargetExecGroupNames);
+      }
+    }
+
+    // Parse each execution platform's exec properties.
+    ImmutableSet<PlatformInfo> executionPlatforms;
+    if (toolchainContexts == null) {
+      executionPlatforms = ImmutableSet.of();
+    } else {
+      executionPlatforms =
+          execGroupNames.stream()
+              .map(name -> toolchainContexts.getToolchainContext(name).executionPlatform())
+              .distinct()
+              .collect(toImmutableSet());
+    }
+    Map<PlatformInfo, ImmutableTable<String, String, String>> parsedPlatformProperties =
+        new LinkedHashMap<>();
+    for (PlatformInfo executionPlatform : executionPlatforms) {
+      ImmutableTable<String, String, String> parsed =
+          parseExecProperties(executionPlatform.execProperties());
+      parsedPlatformProperties.put(executionPlatform, parsed);
+    }
+
+    // First, get the defaults.
+    ImmutableMap<String, String> defaultExecProperties =
+        parsedTargetProperties.row(DEFAULT_EXEC_GROUP_NAME);
+    Table<String, String, String> result = HashBasedTable.create();
+    putAll(result, DEFAULT_EXEC_GROUP_NAME, defaultExecProperties);
+
+    for (String execGroupName : execGroupNames) {
+      ImmutableMap<String, String> combined =
+          computeProperties(
+              execGroupName,
+              defaultExecProperties,
+              toolchainContexts,
+              parsedPlatformProperties,
+              parsedTargetProperties);
+      putAll(result, execGroupName, combined);
+    }
+
+    return ImmutableTable.copyOf(result);
+  }
+
+  private static <R, C, V> void putAll(Table<R, C, V> builder, R row, Map<C, V> values) {
+    for (Map.Entry<C, V> entry : values.entrySet()) {
+      builder.put(row, entry.getKey(), entry.getValue());
+    }
+  }
+
+  private static ImmutableMap<String, String> computeProperties(
+      String execGroupName,
+      ImmutableMap<String, String> defaultExecProperties,
+      @Nullable ToolchainCollection<ResolvedToolchainContext> toolchainContexts,
+      Map<PlatformInfo, ImmutableTable<String, String, String>> parsedPlatformProperties,
+      ImmutableTable<String, String, String> parsedTargetProperties) {
+
+    ImmutableMap<String, String> defaultExecGroupPlatformProperties;
+    ImmutableMap<String, String> platformProperties;
+    if (toolchainContexts == null) {
+      defaultExecGroupPlatformProperties = ImmutableMap.of();
+      platformProperties = ImmutableMap.of();
+    } else {
+      PlatformInfo executionPlatform =
+          toolchainContexts.getToolchainContext(execGroupName).executionPlatform();
+      defaultExecGroupPlatformProperties =
+          parsedPlatformProperties.get(executionPlatform).row(DEFAULT_EXEC_GROUP_NAME);
+      platformProperties = parsedPlatformProperties.get(executionPlatform).row(execGroupName);
+    }
+    Map<String, String> targetProperties =
+        new LinkedHashMap<>(parsedTargetProperties.row(execGroupName));
+    for (String propertyName : defaultExecProperties.keySet()) {
+      // If the property exists in the default and not in the target, copy it.
+      targetProperties.computeIfAbsent(propertyName, defaultExecProperties::get);
+    }
+
+    // Combine the target and exec platform properties. Target properties take precedence.
+    // Use a HashMap instead of an ImmutableMap.Builder because we expect duplicate keys.
+    Map<String, String> combined = new LinkedHashMap<>();
+    combined.putAll(defaultExecGroupPlatformProperties);
+    combined.putAll(defaultExecProperties);
+    combined.putAll(platformProperties);
+    combined.putAll(targetProperties);
+    return ImmutableMap.copyOf(combined);
+  }
+
+  protected abstract ImmutableMap<String, ExecGroup> execGroups();
+
+  protected abstract ImmutableTable<String, String, String> execProperties();
+
+  public ExecGroup getExecGroup(String execGroupName) {
+    return execGroups().get(execGroupName);
+  }
+
+  public ImmutableMap<String, String> getExecProperties(String execGroupName) {
+    return execProperties().row(execGroupName);
+  }
+
+  /**
+   * Parse raw exec properties attribute value into a map of exec group names to their properties.
+   * The raw map can have keys of two forms: (1) 'property' and (2) 'exec_group_name.property'. The
+   * former get parsed into the default exec group, the latter get parsed into their relevant exec
+   * groups.
+   */
+  private static ImmutableTable<String, String, String> parseExecProperties(
+      Map<String, String> rawExecProperties) {
+    ImmutableTable.Builder<String, String, String> execProperties = ImmutableTable.builder();
+    for (Map.Entry<String, String> execProperty : rawExecProperties.entrySet()) {
+      String rawProperty = execProperty.getKey();
+      int delimiterIndex = rawProperty.indexOf('.');
+      if (delimiterIndex == -1) {
+        execProperties.put(DEFAULT_EXEC_GROUP_NAME, rawProperty, execProperty.getValue());
+      } else {
+        String execGroup = rawProperty.substring(0, delimiterIndex);
+        String property = rawProperty.substring(delimiterIndex + 1);
+        execProperties.put(execGroup, property, execProperty.getValue());
+      }
+    }
+    return execProperties.build();
+  }
+
+  /** An error for when the user tries to access a non-existent exec group. */
+  public static final class InvalidExecGroupException extends Exception
+      implements SaneAnalysisException {
+
+    public InvalidExecGroupException(Collection<String> invalidNames) {
+      super(
+          String.format(
+              "Tried to set properties for non-existent exec groups: %s.",
+              invalidNames.stream().collect(joining(","))));
+    }
+
+    @Override
+    public DetailedExitCode getDetailedExitCode() {
+      return DetailedExitCode.of(
+          FailureDetail.newBuilder()
+              .setMessage(getMessage())
+              .setAnalysis(Analysis.newBuilder().setCode(Code.EXEC_GROUP_MISSING))
+              .build());
+    }
+  }
+}
diff --git a/src/main/java/com/google/devtools/build/lib/analysis/RuleContext.java b/src/main/java/com/google/devtools/build/lib/analysis/RuleContext.java
index ce49a4d4a7bb48..2a71d36fe42fb7 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/RuleContext.java
+++ b/src/main/java/com/google/devtools/build/lib/analysis/RuleContext.java
@@ -28,7 +28,6 @@
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedSet;
-import com.google.common.collect.ImmutableTable;
 import com.google.common.collect.Iterables;
 import com.google.common.collect.ListMultimap;
 import com.google.common.collect.Lists;
@@ -44,6 +43,7 @@
 import com.google.devtools.build.lib.actions.Artifact.SpecialArtifact;
 import com.google.devtools.build.lib.actions.ArtifactRoot;
 import com.google.devtools.build.lib.analysis.AliasProvider.TargetMode;
+import com.google.devtools.build.lib.analysis.ExecGroupCollection.InvalidExecGroupException;
 import com.google.devtools.build.lib.analysis.actions.ActionConstructionContext;
 import com.google.devtools.build.lib.analysis.buildinfo.BuildInfoKey;
 import com.google.devtools.build.lib.analysis.config.BuildConfiguration;
@@ -90,12 +90,7 @@
 import com.google.devtools.build.lib.packages.Type;
 import com.google.devtools.build.lib.packages.Type.LabelClass;
 import com.google.devtools.build.lib.packages.semantics.BuildLanguageOptions;
-import com.google.devtools.build.lib.server.FailureDetails.Analysis;
-import com.google.devtools.build.lib.server.FailureDetails.Analysis.Code;
-import com.google.devtools.build.lib.server.FailureDetails.FailureDetail;
 import com.google.devtools.build.lib.skyframe.ConfiguredTargetAndData;
-import com.google.devtools.build.lib.skyframe.SaneAnalysisException;
-import com.google.devtools.build.lib.util.DetailedExitCode;
 import com.google.devtools.build.lib.util.FileTypeSet;
 import com.google.devtools.build.lib.util.OS;
 import com.google.devtools.build.lib.util.OrderedSetMultimap;
@@ -208,10 +203,10 @@ public ImmutableList<TransitiveInfoCollection> getFiles() {
   private final ImmutableList<Class<? extends Fragment>> universalFragments;
   private final RuleErrorConsumer reporter;
   @Nullable private final ToolchainCollection<ResolvedToolchainContext> toolchainContexts;
+  private final ExecGroupCollection execGroupCollection;
   private final ConstraintSemantics<RuleContext> constraintSemantics;
   private final ImmutableSet<String> requiredConfigFragments;
   private final List<Expander> makeVariableExpanders = new ArrayList<>();
-  private final ImmutableTable<String, String, String> execProperties;
 
   /** Map of exec group names to ActionOwners. */
   private final Map<String, ActionOwner> actionOwners = new HashMap<>();
@@ -232,6 +227,7 @@ private RuleContext(
       ActionLookupKey actionLookupKey,
       ImmutableMap<String, Attribute> aspectAttributes,
       @Nullable ToolchainCollection<ResolvedToolchainContext> toolchainContexts,
+      ExecGroupCollection execGroupCollection,
       ConstraintSemantics<RuleContext> constraintSemantics,
       ImmutableSet<String> requiredConfigFragments)
       throws InvalidExecGroupException {
@@ -265,7 +261,7 @@ private RuleContext(
     this.actionOwnerSymbolGenerator = new SymbolGenerator<>(actionLookupKey);
     reporter = builder.reporter;
     this.toolchainContexts = toolchainContexts;
-    this.execProperties = parseExecProperties(builder.rawExecProperties);
+    this.execGroupCollection = execGroupCollection;
     this.constraintSemantics = constraintSemantics;
     this.requiredConfigFragments = requiredConfigFragments;
   }
@@ -483,9 +479,8 @@ public ActionOwner getActionOwner(String execGroup) {
             rule,
             aspectDescriptors,
             getConfiguration(),
-            getExecProperties(execGroup, execProperties),
-            getExecutionPlatform(execGroup),
-            ImmutableSet.of(execGroup));
+            getExecGroups().getExecProperties(execGroup),
+            getExecutionPlatform(execGroup));
     actionOwners.put(execGroup, actionOwner);
     return actionOwner;
   }
@@ -592,47 +587,13 @@ public ImmutableList<Artifact> getBuildInfo(BuildInfoKey key) throws Interrupted
             AnalysisUtils.isStampingEnabled(this, getConfiguration()), key, getConfiguration());
   }
 
-  /**
-   * Computes a map of exec properties given the execution platform, taking only properties in exec
-   * groups that are applicable to this action. Properties for specific exec groups take precedence
-   * over properties that don't specify an exec group.
-   */
-  private static ImmutableMap<String, String> computeExecProperties(
-      Map<String, String> targetExecProperties,
-      @Nullable PlatformInfo executionPlatform,
-      Set<String> execGroups) {
-    Map<String, String> execProperties = new HashMap<>();
-
-    if (executionPlatform != null) {
-      ImmutableTable<String, String, String> execPropertiesPerGroup =
-          parseExecGroups(executionPlatform.execProperties());
-
-      if (execPropertiesPerGroup.containsRow(DEFAULT_EXEC_GROUP_NAME)) {
-        execProperties.putAll(execPropertiesPerGroup.row(DEFAULT_EXEC_GROUP_NAME));
-      }
-
-      for (String execGroup : execPropertiesPerGroup.rowKeySet()) {
-        if (execGroups.contains(execGroup)) {
-          execProperties.putAll(execPropertiesPerGroup.row(execGroup));
-        }
-      }
-    }
-
-    // If the same key occurs both in the platform and in target-specific properties, the
-    // value is taken from target-specific properties (effectively overriding the platform
-    // properties).
-    execProperties.putAll(targetExecProperties);
-    return ImmutableMap.copyOf(execProperties);
-  }
-
   @VisibleForTesting
   public static ActionOwner createActionOwner(
       Rule rule,
       ImmutableList<AspectDescriptor> aspectDescriptors,
       BuildConfiguration configuration,
-      Map<String, String> targetExecProperties,
-      @Nullable PlatformInfo executionPlatform,
-      Set<String> execGroups) {
+      ImmutableMap<String, String> execProperties,
+      @Nullable PlatformInfo executionPlatform) {
     return ActionOwner.create(
         rule.getLabel(),
         aspectDescriptors,
@@ -642,7 +603,7 @@ public static ActionOwner createActionOwner(
         configuration.checksum(),
         configuration.toBuildEvent(),
         configuration.isHostConfiguration() ? HOST_CONFIGURATION_PROGRESS_TAG : null,
-        computeExecProperties(targetExecProperties, executionPlatform, execGroups),
+        execProperties,
         executionPlatform);
   }
 
@@ -1239,6 +1200,10 @@ public ToolchainCollection<ResolvedToolchainContext> getToolchainContexts() {
     return toolchainContexts;
   }
 
+  public ExecGroupCollection getExecGroups() {
+    return execGroupCollection;
+  }
+
   public boolean targetPlatformHasConstraint(ConstraintValueInfo constraintValue) {
     if (toolchainContexts == null || toolchainContexts.getTargetPlatform() == null) {
       return false;
@@ -1273,101 +1238,6 @@ public ImmutableSortedSet<String> getRequiredConfigFragments() {
     return ans.build();
   }
 
-  private ImmutableTable<String, String, String> parseExecProperties(
-      Map<String, String> execProperties) throws InvalidExecGroupException {
-    if (execProperties.isEmpty()) {
-      return ImmutableTable.of();
-    } else {
-      return parseExecProperties(
-          execProperties, toolchainContexts == null ? null : toolchainContexts.getExecGroupNames());
-    }
-  }
-
-  /**
-   * Parse raw exec properties attribute value into a map of exec group names to their properties.
-   * The raw map can have keys of two forms: (1) 'property' and (2) 'exec_group_name.property'. The
-   * former get parsed into the default exec group, the latter get parsed into their relevant exec
-   * groups.
-   */
-  private static ImmutableTable<String, String, String> parseExecGroups(
-      Map<String, String> rawExecProperties) {
-    ImmutableTable.Builder<String, String, String> execProperties = ImmutableTable.builder();
-    for (Map.Entry<String, String> execProperty : rawExecProperties.entrySet()) {
-      String rawProperty = execProperty.getKey();
-      int delimiterIndex = rawProperty.indexOf('.');
-      if (delimiterIndex == -1) {
-        execProperties.put(DEFAULT_EXEC_GROUP_NAME, rawProperty, execProperty.getValue());
-      } else {
-        String execGroup = rawProperty.substring(0, delimiterIndex);
-        String property = rawProperty.substring(delimiterIndex + 1);
-        execProperties.put(execGroup, property, execProperty.getValue());
-      }
-    }
-    return execProperties.build();
-  }
-
-  /**
-   * Parse raw exec properties attribute value into a map of exec group names to their properties.
-   * If given a set of exec groups, validates all the exec groups in the map are applicable to the
-   * action.
-   */
-  private static ImmutableTable<String, String, String> parseExecProperties(
-      Map<String, String> rawExecProperties, @Nullable Set<String> execGroups)
-      throws InvalidExecGroupException {
-    ImmutableTable<String, String, String> consolidatedProperties =
-        parseExecGroups(rawExecProperties);
-    if (execGroups != null) {
-      for (String execGroupName : consolidatedProperties.rowKeySet()) {
-        if (!execGroupName.equals(DEFAULT_EXEC_GROUP_NAME) && !execGroups.contains(execGroupName)) {
-          throw new InvalidExecGroupException(
-              String.format(
-                  "Tried to set properties for non-existent exec group '%s'.", execGroupName));
-        }
-      }
-    }
-
-    return consolidatedProperties;
-  }
-
-  /**
-   * Gets the combined exec properties of the given exec group and the target's exec properties. If
-   * a property is set in both, the exec group properties take precedence. If a non-existent exec
-   * group is passed in, just returns the target's exec properties.
-   *
-   * @param execGroup group whose properties to retrieve
-   * @param execProperties Map of exec group name to map of properties and values
-   */
-  private static ImmutableMap<String, String> getExecProperties(
-      String execGroup, ImmutableTable<String, String, String> execProperties) {
-    if (!execProperties.containsRow(execGroup) || execGroup.equals(DEFAULT_EXEC_GROUP_NAME)) {
-      return execProperties.row(DEFAULT_EXEC_GROUP_NAME);
-    }
-
-    // Use a HashMap to build here because we expect duplicate keys to happen
-    // (and rewrite previous entries).
-    Map<String, String> targetAndGroupProperties =
-        new HashMap<>(execProperties.row(DEFAULT_EXEC_GROUP_NAME));
-    targetAndGroupProperties.putAll(execProperties.row(execGroup));
-    return ImmutableMap.copyOf(targetAndGroupProperties);
-  }
-
-  /** An error for when the user tries to access an non-existent exec group */
-  public static final class InvalidExecGroupException extends Exception
-      implements SaneAnalysisException {
-    InvalidExecGroupException(String message) {
-      super(message);
-    }
-
-    @Override
-    public DetailedExitCode getDetailedExitCode() {
-      return DetailedExitCode.of(
-          FailureDetail.newBuilder()
-              .setMessage(getMessage())
-              .setAnalysis(Analysis.newBuilder().setCode(Code.EXEC_GROUP_MISSING))
-              .build());
-    }
-  }
-
   private void checkAttributeIsDependency(String attributeName) {
     Attribute attributeDefinition = attributes.getAttributeDefinition(attributeName);
     if (attributeDefinition == null) {
@@ -1736,6 +1606,7 @@ public static final class Builder implements RuleErrorConsumer  {
     private ImmutableMap<String, Attribute> aspectAttributes;
     private ImmutableList<Aspect> aspects;
     private ToolchainCollection<ResolvedToolchainContext> toolchainContexts;
+    private ExecGroupCollection.Builder execGroupCollectionBuilder;
     private ImmutableMap<String, String> rawExecProperties;
     private ConstraintSemantics<RuleContext> constraintSemantics;
     private ImmutableSet<String> requiredConfigFragments = ImmutableSet.of();
@@ -1779,14 +1650,6 @@ public RuleContext build() throws InvalidExecGroupException {
       ListMultimap<String, ConfiguredTargetAndData> targetMap = createTargetMap();
       ListMultimap<String, ConfiguredFilesetEntry> filesetEntryMap =
           createFilesetEntryMap(target.getAssociatedRule(), configConditions);
-      if (rawExecProperties == null) {
-        if (!attributes.has(RuleClass.EXEC_PROPERTIES, Type.STRING_DICT)) {
-          rawExecProperties = ImmutableMap.of();
-        } else {
-          rawExecProperties =
-              ImmutableMap.copyOf(attributes.get(RuleClass.EXEC_PROPERTIES, Type.STRING_DICT));
-        }
-      }
       return new RuleContext(
           this,
           attributes,
@@ -1798,10 +1661,26 @@ public RuleContext build() throws InvalidExecGroupException {
           actionOwnerSymbol,
           aspectAttributes != null ? aspectAttributes : ImmutableMap.<String, Attribute>of(),
           toolchainContexts,
+          createExecGroupCollection(execGroupCollectionBuilder, attributes),
           constraintSemantics,
           requiredConfigFragments);
     }
 
+    private ExecGroupCollection createExecGroupCollection(
+        ExecGroupCollection.Builder execGroupCollectionBuilder, AttributeMap attributes)
+        throws InvalidExecGroupException {
+      if (rawExecProperties == null) {
+        if (!attributes.has(RuleClass.EXEC_PROPERTIES, Type.STRING_DICT)) {
+          rawExecProperties = ImmutableMap.of();
+        } else {
+          rawExecProperties =
+              ImmutableMap.copyOf(attributes.get(RuleClass.EXEC_PROPERTIES, Type.STRING_DICT));
+        }
+      }
+
+      return execGroupCollectionBuilder.build(toolchainContexts, rawExecProperties);
+    }
+
     private void checkAttributesNonEmpty(AttributeMap attributes) {
       for (String attributeName : attributes.getAttributeNames()) {
         Attribute attr = attributes.getAttributeDefinition(attributeName);
@@ -1889,6 +1768,12 @@ public Builder setToolchainContexts(
       return this;
     }
 
+    public Builder setExecGroupCollectionBuilder(
+        ExecGroupCollection.Builder execGroupCollectionBuilder) {
+      this.execGroupCollectionBuilder = execGroupCollectionBuilder;
+      return this;
+    }
+
     /**
      * Warning: if you set the exec properties using this method any exec_properties attribute value
      * will be ignored in favor of this value.
diff --git a/src/main/java/com/google/devtools/build/lib/packages/BUILD b/src/main/java/com/google/devtools/build/lib/packages/BUILD
index 3a02fd6f387b87..b0a072d9e59574 100644
--- a/src/main/java/com/google/devtools/build/lib/packages/BUILD
+++ b/src/main/java/com/google/devtools/build/lib/packages/BUILD
@@ -74,6 +74,7 @@ java_library(
         "//src/main/java/com/google/devtools/build/lib/starlarkbuildapi",
         "//third_party:auto_value",
         "//third_party:guava",
+        "//third_party:jsr305",
     ],
 )
 
diff --git a/src/main/java/com/google/devtools/build/lib/packages/ExecGroup.java b/src/main/java/com/google/devtools/build/lib/packages/ExecGroup.java
index a4de2bf17ea9bf..ec56d4854cfe0f 100644
--- a/src/main/java/com/google/devtools/build/lib/packages/ExecGroup.java
+++ b/src/main/java/com/google/devtools/build/lib/packages/ExecGroup.java
@@ -15,11 +15,11 @@
 package com.google.devtools.build.lib.packages;
 
 import com.google.auto.value.AutoValue;
-import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableSet;
 import com.google.devtools.build.lib.cmdline.Label;
 import com.google.devtools.build.lib.starlarkbuildapi.ExecGroupApi;
 import java.util.Set;
+import javax.annotation.Nullable;
 
 /** Resolves the appropriate toolchains for the given parameters. */
 @AutoValue
@@ -27,36 +27,43 @@ public abstract class ExecGroup implements ExecGroupApi {
 
   // This is intentionally a string that would fail {@code Identifier.isValid} so that
   // users can't create a group with the same name.
-  @VisibleForTesting public static final String DEFAULT_EXEC_GROUP_NAME = "default-exec-group";
-
-  // Create an exec group that is marked as copying from the rule.
-  // TODO(b/183268405): Remove this when RuleClass is updated to better handle inheritance.
-  public static ExecGroup createCopied(
-      Set<Label> requiredToolchains, Set<Label> execCompatibleWith) {
-    return create(requiredToolchains, execCompatibleWith, /* copyFromRule= */ true);
-  }
+  public static final String DEFAULT_EXEC_GROUP_NAME = "default-exec-group";
 
   /** Create an exec group that inherits from the default exec group. */
   public static ExecGroup copyFromDefault() {
-    return create(ImmutableSet.of(), ImmutableSet.of(), /* copyFromRule= */ true);
+    return create(ImmutableSet.of(), ImmutableSet.of(), /* copyFrom= */ DEFAULT_EXEC_GROUP_NAME);
   }
 
   /** Create an exec group with the given toolchains and execution constraints. */
   public static ExecGroup create(Set<Label> requiredToolchains, Set<Label> execCompatibleWith) {
-    return create(requiredToolchains, execCompatibleWith, /* copyFromRule= */ false);
+    return create(requiredToolchains, execCompatibleWith, /* copyFrom= */ null);
   }
 
   private static ExecGroup create(
-      Set<Label> requiredToolchains, Set<Label> execCompatibleWith, boolean copyFromRule) {
+      Set<Label> requiredToolchains, Set<Label> execCompatibleWith, @Nullable String copyFrom) {
     return new AutoValue_ExecGroup(
-        ImmutableSet.copyOf(requiredToolchains),
-        ImmutableSet.copyOf(execCompatibleWith),
-        copyFromRule);
+        ImmutableSet.copyOf(requiredToolchains), ImmutableSet.copyOf(execCompatibleWith), copyFrom);
   }
 
   public abstract ImmutableSet<Label> requiredToolchains();
 
   public abstract ImmutableSet<Label> execCompatibleWith();
 
-  public abstract boolean isCopiedFromDefault();
+  @Nullable
+  public abstract String copyFrom();
+
+  /** Creates a new exec group that inherits from the given group. */
+  public ExecGroup inheritFrom(ExecGroup other) {
+    ImmutableSet<Label> requiredToolchains =
+        new ImmutableSet.Builder<Label>()
+            .addAll(this.requiredToolchains())
+            .addAll(other.requiredToolchains())
+            .build();
+    ImmutableSet<Label> execCompatibleWith =
+        new ImmutableSet.Builder<Label>()
+            .addAll(this.execCompatibleWith())
+            .addAll(other.execCompatibleWith())
+            .build();
+    return create(requiredToolchains, execCompatibleWith);
+  }
 }
diff --git a/src/main/java/com/google/devtools/build/lib/packages/RuleClass.java b/src/main/java/com/google/devtools/build/lib/packages/RuleClass.java
index f218342ebf88b6..0c897c8bcc5597 100644
--- a/src/main/java/com/google/devtools/build/lib/packages/RuleClass.java
+++ b/src/main/java/com/google/devtools/build/lib/packages/RuleClass.java
@@ -760,24 +760,7 @@ public Builder(String name, RuleClassType type, boolean starlark, RuleClass... p
         useToolchainTransition = parent.useToolchainTransition;
         addExecutionPlatformConstraints(parent.getExecutionPlatformConstraints());
         try {
-          ImmutableMap.Builder<String, ExecGroup> cleanedExecGroups = new ImmutableMap.Builder<>();
-          // For exec groups that copied toolchains and constraints from the rule, clear
-          // the toolchains and constraints. This prevents multiple inherited rule-copying exec
-          // groups with the same name from different parents from clashing. The toolchains and
-          // constraints will be overwritten with the rule's toolchains and constraints later
-          // anyway (see {@link #build}).
-          // For example, every rule that creates c++ linking actions inherits the rule-copying
-          // exec group "cpp_link". For rules that are the child of multiple of these rules,
-          // we need to clear out whatever toolchains and constraints have been copied from the rule
-          // in order to prevent clashing and fill with the the child's toolchain and constraints.
-          for (Map.Entry<String, ExecGroup> execGroup : parent.getExecGroups().entrySet()) {
-            if (execGroup.getValue().isCopiedFromDefault()) {
-              cleanedExecGroups.put(execGroup.getKey(), ExecGroup.copyFromDefault());
-            } else {
-              cleanedExecGroups.put(execGroup);
-            }
-          }
-          addExecGroups(cleanedExecGroups.build());
+          addExecGroups(parent.getExecGroups());
         } catch (DuplicateExecGroupError e) {
           throw new IllegalArgumentException(
               String.format(
@@ -863,24 +846,6 @@ public RuleClass build(String name, String key) {
         this.useToolchainTransition(false);
       }
 
-      // Any exec groups that have entirely empty toolchains and constraints inherit the rule's
-      // toolchains and constraints. Note that this isn't the same as a target's constraints which
-      // also read from attributes and configuration.
-      Map<String, ExecGroup> execGroupsWithInheritance = new HashMap<>();
-      ExecGroup copiedFromRule = null;
-      for (Map.Entry<String, ExecGroup> groupEntry : execGroups.entrySet()) {
-        ExecGroup group = groupEntry.getValue();
-        if (group.isCopiedFromDefault()) {
-          if (copiedFromRule == null) {
-            copiedFromRule =
-                ExecGroup.createCopied(requiredToolchains, executionPlatformConstraints);
-          }
-          execGroupsWithInheritance.put(groupEntry.getKey(), copiedFromRule);
-        } else {
-          execGroupsWithInheritance.put(groupEntry.getKey(), group);
-        }
-      }
-
       return new RuleClass(
           name,
           callstack,
@@ -915,7 +880,7 @@ public RuleClass build(String name, String key) {
           useToolchainResolution,
           useToolchainTransition,
           executionPlatformConstraints,
-          execGroupsWithInheritance,
+          execGroups,
           outputFileKind,
           attributes.values(),
           buildSetting);
diff --git a/src/main/java/com/google/devtools/build/lib/skyframe/AspectFunction.java b/src/main/java/com/google/devtools/build/lib/skyframe/AspectFunction.java
index c0d460a0f93acf..e9e4bff1739ced 100644
--- a/src/main/java/com/google/devtools/build/lib/skyframe/AspectFunction.java
+++ b/src/main/java/com/google/devtools/build/lib/skyframe/AspectFunction.java
@@ -29,10 +29,10 @@
 import com.google.devtools.build.lib.analysis.ConfiguredTarget;
 import com.google.devtools.build.lib.analysis.DependencyKind;
 import com.google.devtools.build.lib.analysis.DuplicateException;
+import com.google.devtools.build.lib.analysis.ExecGroupCollection.InvalidExecGroupException;
 import com.google.devtools.build.lib.analysis.InconsistentAspectOrderException;
 import com.google.devtools.build.lib.analysis.PlatformOptions;
 import com.google.devtools.build.lib.analysis.ResolvedToolchainContext;
-import com.google.devtools.build.lib.analysis.RuleContext.InvalidExecGroupException;
 import com.google.devtools.build.lib.analysis.TargetAndConfiguration;
 import com.google.devtools.build.lib.analysis.ToolchainCollection;
 import com.google.devtools.build.lib.analysis.config.BuildConfiguration;
diff --git a/src/main/java/com/google/devtools/build/lib/skyframe/BUILD b/src/main/java/com/google/devtools/build/lib/skyframe/BUILD
index 4ff539966e3f22..701161058a750e 100644
--- a/src/main/java/com/google/devtools/build/lib/skyframe/BUILD
+++ b/src/main/java/com/google/devtools/build/lib/skyframe/BUILD
@@ -252,6 +252,7 @@ java_library(
         "//src/main/java/com/google/devtools/build/lib/analysis:dependency_key",
         "//src/main/java/com/google/devtools/build/lib/analysis:dependency_kind",
         "//src/main/java/com/google/devtools/build/lib/analysis:duplicate_exception",
+        "//src/main/java/com/google/devtools/build/lib/analysis:exec_group_collection",
         "//src/main/java/com/google/devtools/build/lib/analysis:inconsistent_aspect_order_exception",
         "//src/main/java/com/google/devtools/build/lib/analysis:platform_options",
         "//src/main/java/com/google/devtools/build/lib/analysis:resolved_toolchain_context",
diff --git a/src/main/java/com/google/devtools/build/lib/skyframe/ConfiguredTargetFunction.java b/src/main/java/com/google/devtools/build/lib/skyframe/ConfiguredTargetFunction.java
index d0b3a230b1b367..a1207eeca90f8c 100644
--- a/src/main/java/com/google/devtools/build/lib/skyframe/ConfiguredTargetFunction.java
+++ b/src/main/java/com/google/devtools/build/lib/skyframe/ConfiguredTargetFunction.java
@@ -38,10 +38,11 @@
 import com.google.devtools.build.lib.analysis.DependencyResolver;
 import com.google.devtools.build.lib.analysis.DuplicateException;
 import com.google.devtools.build.lib.analysis.EmptyConfiguredTarget;
+import com.google.devtools.build.lib.analysis.ExecGroupCollection;
+import com.google.devtools.build.lib.analysis.ExecGroupCollection.InvalidExecGroupException;
 import com.google.devtools.build.lib.analysis.InconsistentAspectOrderException;
 import com.google.devtools.build.lib.analysis.PlatformConfiguration;
 import com.google.devtools.build.lib.analysis.ResolvedToolchainContext;
-import com.google.devtools.build.lib.analysis.RuleContext.InvalidExecGroupException;
 import com.google.devtools.build.lib.analysis.TargetAndConfiguration;
 import com.google.devtools.build.lib.analysis.ToolchainCollection;
 import com.google.devtools.build.lib.analysis.ToolchainContext;
@@ -268,6 +269,7 @@ public SkyValue compute(SkyKey key, Environment env) throws ConfiguredTargetFunc
     SkyframeDependencyResolver resolver = view.createDependencyResolver(env);
 
     ToolchainCollection<UnloadedToolchainContext> unloadedToolchainContexts = null;
+    ExecGroupCollection.Builder execGroupCollectionBuilder = null;
 
     // TODO(janakr): this call may tie up this thread indefinitely, reducing the parallelism of
     //  Skyframe. This is a strict improvement over the prior state of the code, in which we ran
@@ -276,7 +278,7 @@ public SkyValue compute(SkyKey key, Environment env) throws ConfiguredTargetFunc
     acquireWithLogging(key);
     try {
       // Determine what toolchains are needed by this target.
-      unloadedToolchainContexts =
+      ComputedToolchainContexts result =
           computeUnloadedToolchainContexts(
               env,
               ruleClassProvider,
@@ -286,6 +288,8 @@ public SkyValue compute(SkyKey key, Environment env) throws ConfiguredTargetFunc
       if (env.valuesMissing()) {
         return null;
       }
+      unloadedToolchainContexts = result.toolchainCollection;
+      execGroupCollectionBuilder = result.execGroupCollectionBuilder;
 
       // Get the configuration targets that trigger this rule's configurable attributes.
       ImmutableMap<Label, ConfigMatchingProvider> configConditions =
@@ -377,6 +381,7 @@ public SkyValue compute(SkyKey key, Environment env) throws ConfiguredTargetFunc
               depValueMap,
               configConditions,
               toolchainContexts,
+              execGroupCollectionBuilder,
               transitivePackagesForPackageRootResolution);
       if (configuredTargetProgress != null) {
         configuredTargetProgress.doneConfigureTarget();
@@ -454,15 +459,25 @@ public SkyValue compute(SkyKey key, Environment env) throws ConfiguredTargetFunc
   }
 
   /**
-   * Returns the {@link UnloadedToolchainContext} for this target, or {@code null} if the target
-   * doesn't use toolchains.
+   * Simple wrapper to allow returning two variables from {@link #computeUnloadedToolchainContexts}.
+   */
+  @VisibleForTesting
+  public static class ComputedToolchainContexts {
+    @Nullable public ToolchainCollection<UnloadedToolchainContext> toolchainCollection = null;
+    public ExecGroupCollection.Builder execGroupCollectionBuilder =
+        ExecGroupCollection.emptyBuilder();
+  }
+
+  /**
+   * Returns the toolchain context and exec group collection for this target. The toolchain context
+   * may be {@code null} if the target doesn't use toolchains.
    *
    * <p>This involves Skyframe evaluation: callers should check {@link Environment#valuesMissing()
    * to check the result is valid.
    */
   @VisibleForTesting
   @Nullable
-  public static ToolchainCollection<UnloadedToolchainContext> computeUnloadedToolchainContexts(
+  public static ComputedToolchainContexts computeUnloadedToolchainContexts(
       Environment env,
       RuleClassProvider ruleClassProvider,
       BuildOptions defaultBuildOptions,
@@ -470,12 +485,9 @@ public static ToolchainCollection<UnloadedToolchainContext> computeUnloadedToolc
       @Nullable ToolchainContextKey parentToolchainContextKey)
       throws InterruptedException, ToolchainException {
     if (!(targetAndConfig.getTarget() instanceof Rule)) {
-      return null;
+      return new ComputedToolchainContexts();
     }
     Rule rule = ((Rule) targetAndConfig.getTarget());
-    if (!rule.getRuleClassObject().useToolchainResolution()) {
-      return null;
-    }
     BuildConfiguration configuration = targetAndConfig.getConfiguration();
 
     ImmutableSet<Label> requiredDefaultToolchains =
@@ -485,7 +497,18 @@ public static ToolchainCollection<UnloadedToolchainContext> computeUnloadedToolc
         getExecutionPlatformConstraints(
             rule, configuration.getFragment(PlatformConfiguration.class));
 
-    ImmutableMap<String, ExecGroup> execGroups = rule.getRuleClassObject().getExecGroups();
+    // Create a merged version of the exec groups that handles exec group inheritance properly.
+    ExecGroup defaultExecGroup =
+        ExecGroup.create(requiredDefaultToolchains, defaultExecConstraintLabels);
+    ExecGroupCollection.Builder execGroupCollectionBuilder =
+        ExecGroupCollection.builder(defaultExecGroup, rule.getRuleClassObject().getExecGroups());
+
+    // Short circuit and end now if this target doesn't require toolchain resolution.
+    if (!rule.getRuleClassObject().useToolchainResolution()) {
+      ComputedToolchainContexts result = new ComputedToolchainContexts();
+      result.execGroupCollectionBuilder = execGroupCollectionBuilder;
+      return result;
+    }
 
     // The toolchain context's options are the parent rule's options with manual trimming
     // auto-applied. This means toolchains don't inherit feature flags. This helps build
@@ -550,10 +573,10 @@ public static ToolchainCollection<UnloadedToolchainContext> computeUnloadedToolc
 
     ToolchainContextKey toolchainContextKey = toolchainContextKeyBuilder.build();
     toolchainContextKeys.put(targetUnloadedToolchainContext, toolchainContextKey);
-    for (Map.Entry<String, ExecGroup> group : execGroups.entrySet()) {
-      ExecGroup execGroup = group.getValue();
+    for (String name : execGroupCollectionBuilder.getExecGroupNames()) {
+      ExecGroup execGroup = execGroupCollectionBuilder.getExecGroup(name);
       toolchainContextKeys.put(
-          group.getKey(),
+          name,
           ToolchainContextKey.key()
               .configurationKey(toolchainConfig)
               .requiredToolchainTypeLabels(execGroup.requiredToolchains())
@@ -583,7 +606,10 @@ public static ToolchainCollection<UnloadedToolchainContext> computeUnloadedToolc
       }
     }
 
-    return valuesMissing ? null : toolchainContexts.build();
+    ComputedToolchainContexts result = new ComputedToolchainContexts();
+    result.toolchainCollection = valuesMissing ? null : toolchainContexts.build();
+    result.execGroupCollectionBuilder = execGroupCollectionBuilder;
+    return result;
   }
 
   /**
@@ -1002,6 +1028,7 @@ private ConfiguredTargetValue createConfiguredTarget(
       OrderedSetMultimap<DependencyKind, ConfiguredTargetAndData> depValueMap,
       ImmutableMap<Label, ConfigMatchingProvider> configConditions,
       @Nullable ToolchainCollection<ResolvedToolchainContext> toolchainContexts,
+      ExecGroupCollection.Builder execGroupCollectionBuilder,
       @Nullable NestedSetBuilder<Package> transitivePackagesForPackageRootResolution)
       throws ConfiguredTargetFunctionException, InterruptedException {
     StoredEventHandler events = new StoredEventHandler();
@@ -1022,7 +1049,8 @@ private ConfiguredTargetValue createConfiguredTarget(
               configuredTargetKey,
               depValueMap,
               configConditions,
-              toolchainContexts);
+              toolchainContexts,
+              execGroupCollectionBuilder);
     } catch (MissingDepException e) {
       Preconditions.checkState(env.valuesMissing(), e.getMessage());
       return null;
diff --git a/src/main/java/com/google/devtools/build/lib/skyframe/SkyframeBuildView.java b/src/main/java/com/google/devtools/build/lib/skyframe/SkyframeBuildView.java
index 02abf4d21752d5..1b398c77f416e9 100644
--- a/src/main/java/com/google/devtools/build/lib/skyframe/SkyframeBuildView.java
+++ b/src/main/java/com/google/devtools/build/lib/skyframe/SkyframeBuildView.java
@@ -46,8 +46,9 @@
 import com.google.devtools.build.lib.analysis.ConfiguredTarget;
 import com.google.devtools.build.lib.analysis.ConfiguredTargetFactory;
 import com.google.devtools.build.lib.analysis.DependencyKind;
+import com.google.devtools.build.lib.analysis.ExecGroupCollection;
+import com.google.devtools.build.lib.analysis.ExecGroupCollection.InvalidExecGroupException;
 import com.google.devtools.build.lib.analysis.ResolvedToolchainContext;
-import com.google.devtools.build.lib.analysis.RuleContext.InvalidExecGroupException;
 import com.google.devtools.build.lib.analysis.ToolchainCollection;
 import com.google.devtools.build.lib.analysis.TopLevelArtifactContext;
 import com.google.devtools.build.lib.analysis.ViewCreationFailedException;
@@ -928,7 +929,8 @@ ConfiguredTarget createConfiguredTarget(
       ConfiguredTargetKey configuredTargetKey,
       OrderedSetMultimap<DependencyKind, ConfiguredTargetAndData> prerequisiteMap,
       ImmutableMap<Label, ConfigMatchingProvider> configConditions,
-      @Nullable ToolchainCollection<ResolvedToolchainContext> toolchainContexts)
+      @Nullable ToolchainCollection<ResolvedToolchainContext> toolchainContexts,
+      ExecGroupCollection.Builder execGroupCollectionBuilder)
       throws InterruptedException, ActionConflictException, InvalidExecGroupException {
     Preconditions.checkState(
         enableAnalysis, "Already in execution phase %s %s", target, configuration);
@@ -944,7 +946,8 @@ ConfiguredTarget createConfiguredTarget(
         configuredTargetKey,
         prerequisiteMap,
         configConditions,
-        toolchainContexts);
+        toolchainContexts,
+        execGroupCollectionBuilder);
   }
 
   /**
diff --git a/src/test/java/com/google/devtools/build/lib/analysis/BUILD b/src/test/java/com/google/devtools/build/lib/analysis/BUILD
index 3dc2811b17566c..4b815efab6b33f 100644
--- a/src/test/java/com/google/devtools/build/lib/analysis/BUILD
+++ b/src/test/java/com/google/devtools/build/lib/analysis/BUILD
@@ -88,6 +88,7 @@ java_library(
         "//src/main/java/com/google/devtools/build/lib/analysis:dependency",
         "//src/main/java/com/google/devtools/build/lib/analysis:dependency_key",
         "//src/main/java/com/google/devtools/build/lib/analysis:dependency_kind",
+        "//src/main/java/com/google/devtools/build/lib/analysis:exec_group_collection",
         "//src/main/java/com/google/devtools/build/lib/analysis:extra_action_artifacts_provider",
         "//src/main/java/com/google/devtools/build/lib/analysis:file_provider",
         "//src/main/java/com/google/devtools/build/lib/analysis:label_expander",
diff --git a/src/test/java/com/google/devtools/build/lib/analysis/StarlarkExecGroupTest.java b/src/test/java/com/google/devtools/build/lib/analysis/StarlarkExecGroupTest.java
index 5ed82ef3093875..2cd3763bd17eca 100644
--- a/src/test/java/com/google/devtools/build/lib/analysis/StarlarkExecGroupTest.java
+++ b/src/test/java/com/google/devtools/build/lib/analysis/StarlarkExecGroupTest.java
@@ -15,14 +15,13 @@
 package com.google.devtools.build.lib.analysis;
 
 import static com.google.common.truth.Truth.assertThat;
-import static com.google.devtools.build.lib.analysis.testing.ExecGroupSubject.assertThat;
+import static com.google.devtools.build.lib.analysis.testing.ExecGroupCollectionSubject.assertThat;
 import static com.google.devtools.build.lib.packages.ExecGroup.DEFAULT_EXEC_GROUP_NAME;
 
 import com.google.common.collect.ImmutableMap;
 import com.google.devtools.build.lib.analysis.config.BuildConfiguration;
 import com.google.devtools.build.lib.analysis.util.BuildViewTestCase;
 import com.google.devtools.build.lib.cmdline.Label;
-import com.google.devtools.build.lib.packages.ExecGroup;
 import com.google.devtools.build.lib.packages.Provider;
 import com.google.devtools.build.lib.packages.StarlarkProvider;
 import com.google.devtools.build.lib.packages.StructImpl;
@@ -388,12 +387,11 @@ public void testInheritsRuleRequirements() throws Exception {
     scratch.file("test/BUILD", "load('//test:defs.bzl', 'my_rule')", "my_rule(name = 'papaya')");
 
     ConfiguredTarget ct = getConfiguredTarget("//test:papaya");
-    ImmutableMap<String, ExecGroup> execGroups =
-        getRuleContext(ct).getRule().getRuleClassObject().getExecGroups();
-    assertThat(execGroups).containsKey("watermelon");
-    ExecGroup watermelon = execGroups.get("watermelon");
-    assertThat(watermelon).hasRequiredToolchain("//rule:toolchain_type_1");
-    assertThat(watermelon).hasExecCompatibleWith("//platform:constraint_1");
+    ExecGroupCollection execGroups = getRuleContext(ct).getExecGroups();
+    assertThat(execGroups).isNotNull();
+    assertThat(execGroups).hasExecGroup("watermelon");
+    assertThat(execGroups).execGroup("watermelon").hasRequiredToolchain("//rule:toolchain_type_1");
+    assertThat(execGroups).execGroup("watermelon").hasExecCompatibleWith("//platform:constraint_1");
   }
 
   @Test
diff --git a/src/test/java/com/google/devtools/build/lib/analysis/testing/BUILD b/src/test/java/com/google/devtools/build/lib/analysis/testing/BUILD
index 7017d8b3f2b4ad..3ee467b588dbd5 100644
--- a/src/test/java/com/google/devtools/build/lib/analysis/testing/BUILD
+++ b/src/test/java/com/google/devtools/build/lib/analysis/testing/BUILD
@@ -16,6 +16,7 @@ java_library(
     name = "testing",
     testonly = 1,
     srcs = [
+        "ExecGroupCollectionSubject.java",
         "ExecGroupSubject.java",
         "ResolvedToolchainContextSubject.java",
         "ToolchainCollectionSubject.java",
@@ -23,6 +24,7 @@ java_library(
         "ToolchainInfoSubject.java",
     ],
     deps = [
+        "//src/main/java/com/google/devtools/build/lib/analysis:exec_group_collection",
         "//src/main/java/com/google/devtools/build/lib/analysis:resolved_toolchain_context",
         "//src/main/java/com/google/devtools/build/lib/analysis:toolchain_collection",
         "//src/main/java/com/google/devtools/build/lib/analysis:toolchain_context",
diff --git a/src/test/java/com/google/devtools/build/lib/analysis/testing/ExecGroupCollectionSubject.java b/src/test/java/com/google/devtools/build/lib/analysis/testing/ExecGroupCollectionSubject.java
new file mode 100644
index 00000000000000..ec03fb098164b8
--- /dev/null
+++ b/src/test/java/com/google/devtools/build/lib/analysis/testing/ExecGroupCollectionSubject.java
@@ -0,0 +1,56 @@
+// Copyright 2021 The Bazel Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package com.google.devtools.build.lib.analysis.testing;
+
+import static com.google.common.truth.Truth.assertAbout;
+import static com.google.devtools.build.lib.analysis.testing.ExecGroupSubject.execGroups;
+
+import com.google.common.truth.FailureMetadata;
+import com.google.common.truth.Subject;
+import com.google.devtools.build.lib.analysis.ExecGroupCollection;
+
+/** A Truth {@link Subject} for {@link ExecGroupCollection}. */
+public class ExecGroupCollectionSubject extends Subject {
+  // Static data.
+
+  /** Entry point for test assertions related to {@link ExecGroupCollection}. */
+  public static ExecGroupCollectionSubject assertThat(ExecGroupCollection execGroupCollection) {
+    return assertAbout(ExecGroupCollectionSubject::new).that(execGroupCollection);
+  }
+
+  /** Static method for getting the subject factory (for use with assertAbout()). */
+  public static Factory<ExecGroupCollectionSubject, ExecGroupCollection> execGroupCollection() {
+    return ExecGroupCollectionSubject::new;
+  }
+
+  // Instance fields.
+
+  private final ExecGroupCollection actual;
+
+  protected ExecGroupCollectionSubject(
+      FailureMetadata failureMetadata, ExecGroupCollection subject) {
+    super(failureMetadata, subject);
+    this.actual = subject;
+  }
+
+  public ExecGroupSubject execGroup(String execGroupName) {
+    return check("execGroup(%s)", execGroupName)
+        .about(execGroups())
+        .that(actual.getExecGroup(execGroupName));
+  }
+
+  public void hasExecGroup(String execGroupName) {
+    this.execGroup(execGroupName).isNotNull();
+  }
+}
diff --git a/src/test/java/com/google/devtools/build/lib/analysis/testing/ExecGroupSubject.java b/src/test/java/com/google/devtools/build/lib/analysis/testing/ExecGroupSubject.java
index 3c49c15b09103e..dd8cea7f04156b 100644
--- a/src/test/java/com/google/devtools/build/lib/analysis/testing/ExecGroupSubject.java
+++ b/src/test/java/com/google/devtools/build/lib/analysis/testing/ExecGroupSubject.java
@@ -15,9 +15,9 @@
 
 import static com.google.common.truth.Truth.assertAbout;
 
-import com.google.common.truth.BooleanSubject;
 import com.google.common.truth.FailureMetadata;
 import com.google.common.truth.IterableSubject;
+import com.google.common.truth.StringSubject;
 import com.google.common.truth.Subject;
 import com.google.devtools.build.lib.cmdline.Label;
 import com.google.devtools.build.lib.packages.ExecGroup;
@@ -72,7 +72,11 @@ public void hasExecCompatibleWith(Label constraintLabel) {
     execCompatibleWith().contains(constraintLabel);
   }
 
-  public BooleanSubject isCopiedFromDefault() {
-    return check("isCopiedFromDefault()").that(actual.isCopiedFromDefault());
+  public StringSubject copiesFrom() {
+    return check("copyFrom()").that(actual.copyFrom());
+  }
+
+  public void copiesFromDefault() {
+    copiesFrom().isEqualTo(ExecGroup.DEFAULT_EXEC_GROUP_NAME);
   }
 }
diff --git a/src/test/java/com/google/devtools/build/lib/analysis/util/BUILD b/src/test/java/com/google/devtools/build/lib/analysis/util/BUILD
index 1b3fb9230b2008..8041c0d7d80341 100644
--- a/src/test/java/com/google/devtools/build/lib/analysis/util/BUILD
+++ b/src/test/java/com/google/devtools/build/lib/analysis/util/BUILD
@@ -63,6 +63,7 @@ java_library(
         "//src/main/java/com/google/devtools/build/lib/analysis:configured_target",
         "//src/main/java/com/google/devtools/build/lib/analysis:dependency_key",
         "//src/main/java/com/google/devtools/build/lib/analysis:dependency_kind",
+        "//src/main/java/com/google/devtools/build/lib/analysis:exec_group_collection",
         "//src/main/java/com/google/devtools/build/lib/analysis:extra_action_artifacts_provider",
         "//src/main/java/com/google/devtools/build/lib/analysis:file_provider",
         "//src/main/java/com/google/devtools/build/lib/analysis:inconsistent_aspect_order_exception",
@@ -89,7 +90,6 @@ java_library(
         "//src/main/java/com/google/devtools/build/lib/events",
         "//src/main/java/com/google/devtools/build/lib/exec:execution_options",
         "//src/main/java/com/google/devtools/build/lib/packages",
-        "//src/main/java/com/google/devtools/build/lib/packages:exec_group",
         "//src/main/java/com/google/devtools/build/lib/packages/semantics",
         "//src/main/java/com/google/devtools/build/lib/pkgcache",
         "//src/main/java/com/google/devtools/build/lib/rules:repository/local_repository_rule",
@@ -108,7 +108,6 @@ java_library(
         "//src/main/java/com/google/devtools/build/lib/skyframe:sky_functions",
         "//src/main/java/com/google/devtools/build/lib/skyframe:skyframe_cluster",
         "//src/main/java/com/google/devtools/build/lib/skyframe:target_pattern_phase_value",
-        "//src/main/java/com/google/devtools/build/lib/skyframe:toolchain_context_key",
         "//src/main/java/com/google/devtools/build/lib/skyframe:toolchain_exception",
         "//src/main/java/com/google/devtools/build/lib/skyframe:unloaded_toolchain_context",
         "//src/main/java/com/google/devtools/build/lib/skyframe/packages:PackageFactoryBuilderWithSkyframeForTesting",
diff --git a/src/test/java/com/google/devtools/build/lib/analysis/util/BuildViewForTesting.java b/src/test/java/com/google/devtools/build/lib/analysis/util/BuildViewForTesting.java
index d3279cc48cc33c..1e63067225dda4 100644
--- a/src/test/java/com/google/devtools/build/lib/analysis/util/BuildViewForTesting.java
+++ b/src/test/java/com/google/devtools/build/lib/analysis/util/BuildViewForTesting.java
@@ -37,10 +37,11 @@
 import com.google.devtools.build.lib.analysis.DependencyKey;
 import com.google.devtools.build.lib.analysis.DependencyKind;
 import com.google.devtools.build.lib.analysis.DependencyResolver;
+import com.google.devtools.build.lib.analysis.ExecGroupCollection;
+import com.google.devtools.build.lib.analysis.ExecGroupCollection.InvalidExecGroupException;
 import com.google.devtools.build.lib.analysis.InconsistentAspectOrderException;
 import com.google.devtools.build.lib.analysis.ResolvedToolchainContext;
 import com.google.devtools.build.lib.analysis.RuleContext;
-import com.google.devtools.build.lib.analysis.RuleContext.InvalidExecGroupException;
 import com.google.devtools.build.lib.analysis.TargetAndConfiguration;
 import com.google.devtools.build.lib.analysis.ToolchainCollection;
 import com.google.devtools.build.lib.analysis.ToolchainContext;
@@ -81,6 +82,7 @@
 import com.google.devtools.build.lib.skyframe.BuildConfigurationValue;
 import com.google.devtools.build.lib.skyframe.ConfiguredTargetAndData;
 import com.google.devtools.build.lib.skyframe.ConfiguredTargetFunction;
+import com.google.devtools.build.lib.skyframe.ConfiguredTargetFunction.ComputedToolchainContexts;
 import com.google.devtools.build.lib.skyframe.ConfiguredTargetKey;
 import com.google.devtools.build.lib.skyframe.SkyFunctionEnvironmentForTesting;
 import com.google.devtools.build.lib.skyframe.SkyframeBuildView;
@@ -512,7 +514,7 @@ public RuleContext getRuleContextForTesting(
     SkyFunctionEnvironmentForTesting skyfunctionEnvironment =
         skyframeExecutor.getSkyFunctionEnvironmentForTesting(eventHandler);
 
-    ToolchainCollection<UnloadedToolchainContext> unloadedToolchainCollection =
+    ComputedToolchainContexts result =
         ConfiguredTargetFunction.computeUnloadedToolchainContexts(
             skyfunctionEnvironment,
             ruleClassProvider,
@@ -520,6 +522,10 @@ public RuleContext getRuleContextForTesting(
             new TargetAndConfiguration(target.getAssociatedRule(), targetConfig),
             null);
 
+    ToolchainCollection<UnloadedToolchainContext> unloadedToolchainCollection =
+        result.toolchainCollection;
+    ExecGroupCollection.Builder execGroupCollectionBuilder = result.execGroupCollectionBuilder;
+
     OrderedSetMultimap<DependencyKind, ConfiguredTargetAndData> prerequisiteMap =
         getPrerequisiteMapForTesting(
             eventHandler,
@@ -563,6 +569,7 @@ public RuleContext getRuleContextForTesting(
         .setConfigConditions(ImmutableMap.<Label, ConfigMatchingProvider>of())
         .setUniversalFragments(ruleClassProvider.getUniversalFragments())
         .setToolchainContexts(resolvedToolchainContext.build())
+        .setExecGroupCollectionBuilder(execGroupCollectionBuilder)
         .setConstraintSemantics(ruleClassProvider.getConstraintSemantics())
         .build();
   }
diff --git a/src/test/java/com/google/devtools/build/lib/packages/RuleClassBuilderTest.java b/src/test/java/com/google/devtools/build/lib/packages/RuleClassBuilderTest.java
index 7bfebabc31d98f..ba19a6ed3f4cc0 100644
--- a/src/test/java/com/google/devtools/build/lib/packages/RuleClassBuilderTest.java
+++ b/src/test/java/com/google/devtools/build/lib/packages/RuleClassBuilderTest.java
@@ -232,14 +232,13 @@ public void testDuplicateExecGroupsThatInheritFromRuleIsOk() throws Exception {
             .add(attr("tags", STRING_LIST))
             .addRequiredToolchains(Label.parseAbsoluteUnchecked("//some/other/toolchain"))
             .build();
-    Label cToolchain = Label.parseAbsoluteUnchecked("//actual/toolchain/we/care/about");
     RuleClass c =
         new RuleClass.Builder("$ruleC", RuleClassType.ABSTRACT, false, a, b)
-            .addRequiredToolchains(cToolchain)
+            .addRequiredToolchains(Label.parseAbsoluteUnchecked("//actual/toolchain/we/care/about"))
             .build();
     assertThat(c.getExecGroups()).containsKey("blueberry");
     ExecGroup blueberry = c.getExecGroups().get("blueberry");
-    assertThat(blueberry).isCopiedFromDefault().isTrue();
+    assertThat(blueberry).copiesFromDefault();
   }
 
   @Test
diff --git a/src/test/java/com/google/devtools/build/lib/skyframe/ToolchainsForTargetsTest.java b/src/test/java/com/google/devtools/build/lib/skyframe/ToolchainsForTargetsTest.java
index 3e3066d484fea8..4513a145b9328a 100644
--- a/src/test/java/com/google/devtools/build/lib/skyframe/ToolchainsForTargetsTest.java
+++ b/src/test/java/com/google/devtools/build/lib/skyframe/ToolchainsForTargetsTest.java
@@ -27,6 +27,7 @@
 import com.google.devtools.build.lib.analysis.util.AnalysisTestCase;
 import com.google.devtools.build.lib.cmdline.Label;
 import com.google.devtools.build.lib.packages.RuleClassProvider;
+import com.google.devtools.build.lib.skyframe.ConfiguredTargetFunction.ComputedToolchainContexts;
 import com.google.devtools.build.lib.skyframe.util.SkyframeExecutorTestUtils;
 import com.google.devtools.build.lib.testutil.Suite;
 import com.google.devtools.build.lib.testutil.TestSpec;
@@ -118,14 +119,19 @@ public SkyValue compute(SkyKey skyKey, Environment env)
         throws ComputeUnloadedToolchainContextsException, InterruptedException {
       try {
         Key key = (Key) skyKey.argument();
-        ToolchainCollection<UnloadedToolchainContext> toolchainCollection =
+        ComputedToolchainContexts result =
             ConfiguredTargetFunction.computeUnloadedToolchainContexts(
                 env,
                 stateProvider.lateBoundRuleClassProvider(),
                 buildOptionsSupplier.get(),
                 key.targetAndConfiguration(),
                 key.configuredTargetKey().getToolchainContextKey());
-        return env.valuesMissing() ? null : Value.create(toolchainCollection);
+        if (env.valuesMissing()) {
+          return null;
+        }
+        ToolchainCollection<UnloadedToolchainContext> toolchainCollection =
+            result.toolchainCollection;
+        return Value.create(toolchainCollection);
       } catch (ToolchainException e) {
         throw new ComputeUnloadedToolchainContextsException(e);
       }
diff --git a/src/test/shell/integration/exec_group_test.sh b/src/test/shell/integration/exec_group_test.sh
index cf67f08211b406..ddd7d14e132dda 100755
--- a/src/test/shell/integration/exec_group_test.sh
+++ b/src/test/shell/integration/exec_group_test.sh
@@ -19,7 +19,6 @@
 
 # --- begin runfiles.bash initialization ---
 # Copy-pasted from Bazel's Bash runfiles library (tools/bash/runfiles/runfiles.bash).
-set -euo pipefail
 if [[ ! -d "${RUNFILES_DIR:-/dev/null}" && ! -f "${RUNFILES_MANIFEST_FILE:-/dev/null}" ]]; then
   if [[ -f "$0.runfiles_manifest" ]]; then
     export RUNFILES_MANIFEST_FILE="$0.runfiles_manifest"
@@ -412,6 +411,51 @@ EOF
   grep "test_override" out.txt || fail "Did not find the overriding test-action value"
 }
 
+function test_platform_execgroup_properties_test_inherits_default() {
+  local -r pkg=${FUNCNAME[0]}
+  mkdir $pkg || fail "mkdir $pkg"
+  cat > ${pkg}/a.cc <<EOF
+int main() {}
+EOF
+  cat > ${pkg}/BUILD <<EOF
+constraint_setting(name = "setting")
+constraint_value(name = "local", constraint_setting = ":setting")
+cc_test(
+  name = "a",
+  srcs = ["a.cc"],
+  exec_compatible_with = [":local"],
+)
+
+# This platform should be first in --extra_execution_platforms.
+# It has no constraints and only exists to detect if the correct platform is not
+# used.
+platform(
+    name = "platform_no_constraint",
+    parents = ["${default_host_platform}"],
+    exec_properties = {
+        "exec_property": "no_constraint",
+    },
+)
+
+# This platform should be second. The constraint means it will be used for
+# the cc_test.
+# The exec_property should be used for the actual test execution.
+platform(
+    name = "platform_with_constraint",
+    parents = ["${default_host_platform}"],
+    exec_properties = {
+        "exec_property": "requires_test_constraint",
+    },
+    constraint_values = [":local"],
+)
+EOF
+
+  bazel test --extra_execution_platforms="${pkg}:platform_no_constraint,${pkg}:platform_with_constraint" ${pkg}:a --execution_log_json_file out.txt || fail "Test failed"
+  grep --after=4 "platform" out.txt | grep "exec_property" || fail "Did not find the property key"
+  grep --after=4 "platform" out.txt | grep "no_constraint" && fail "Found the wrong property."
+  grep --after=4 "platform" out.txt | grep "requires_test_constraint" || fail "Did not find the property value"
+}
+
 function test_platform_properties_only_applied_for_relevant_execgroups_cc_test() {
   local -r pkg=${FUNCNAME[0]}
   mkdir $pkg || fail "mkdir $pkg"
@@ -462,5 +506,195 @@ EOF
   grep "Tried to set properties for non-existent exec group" $TEST_log || fail "Did not complain about unknown exec group"
 }
 
-run_suite "exec group test"
+function write_toolchains_for_exec_group_tests() {
+  mkdir -p ${pkg}/platform
+  cat >> ${pkg}/platform/toolchain.bzl <<EOF
+def _impl(ctx):
+  toolchain = platform_common.ToolchainInfo(
+      message = ctx.attr.message)
+  return [toolchain]
+
+test_toolchain = rule(
+    implementation = _impl,
+    attrs = {
+        'message': attr.string(),
+    }
+)
+EOF
+
+  cat >> ${pkg}/platform/BUILD <<EOF
+package(default_visibility = ['//visibility:public'])
+toolchain_type(name = 'toolchain_type')
+
+constraint_setting(name = 'setting')
+constraint_value(name = 'value_foo', constraint_setting = ':setting')
+constraint_value(name = 'value_bar', constraint_setting = ':setting')
+
+load(':toolchain.bzl', 'test_toolchain')
+
+# Define the toolchains.
+test_toolchain(
+    name = 'test_toolchain_impl_foo',
+    message = 'foo',
+)
+test_toolchain(
+    name = 'test_toolchain_impl_bar',
+    message = 'bar',
+)
+
+# Declare the toolchains.
+toolchain(
+    name = 'test_toolchain_foo',
+    toolchain_type = ':toolchain_type',
+    exec_compatible_with = [
+        ':value_foo',
+    ],
+    target_compatible_with = [],
+    toolchain = ':test_toolchain_impl_foo',
+)
+toolchain(
+    name = 'test_toolchain_bar',
+    toolchain_type = ':toolchain_type',
+    exec_compatible_with = [
+        ':value_bar',
+    ],
+    target_compatible_with = [],
+    toolchain = ':test_toolchain_impl_bar',
+)
 
+# Define the platforms.
+platform(
+    name = 'platform_foo',
+    constraint_values = [':value_foo'],
+)
+platform(
+    name = 'platform_bar',
+    constraint_values = [':value_bar'],
+)
+EOF
+
+  cat >> WORKSPACE <<EOF
+register_toolchains('//${pkg}/platform:all')
+register_execution_platforms('//${pkg}/platform:all')
+EOF
+}
+
+# Test basic inheritance of constraints and toolchains on a single rule.
+function test_exec_group_rule_constraint_inheritance() {
+  local -r pkg=${FUNCNAME[0]}
+  mkdir $pkg || fail "mkdir $pkg"
+
+  write_toolchains_for_exec_group_tests
+
+  # Add a rule with default execution constraints.
+  mkdir -p ${pkg}/demo
+  cat >> ${pkg}/demo/rule.bzl <<EOF
+def _impl(ctx):
+    toolchain = ctx.toolchains['//${pkg}/platform:toolchain_type']
+    out_file_main = ctx.actions.declare_file("%s.log" % ctx.attr.name)
+    ctx.actions.run_shell(
+        outputs = [out_file_main],
+        command = "echo 'hi from %s, toolchain says %s' > '%s'" %
+            (ctx.attr.name, toolchain.message, out_file_main.path),
+    )
+
+    out_file_extra = ctx.actions.declare_file("%s_extra.log" % ctx.attr.name)
+    extra_toolchain = ctx.exec_groups['extra'].toolchains['//${pkg}/platform:toolchain_type']
+    ctx.actions.run_shell(
+        outputs = [out_file_extra],
+        command = "echo 'extra from %s, toolchain says %s' > '%s'" %
+            (ctx.attr.name, extra_toolchain.message, out_file_extra.path),
+    )
+
+    return [DefaultInfo(files = depset([out_file_main, out_file_extra]))]
+
+sample_rule = rule(
+    implementation = _impl,
+    exec_groups = {
+        # extra should inherit both the exec constraint and the toolchain.
+        'extra': exec_group(copy_from_rule = True),
+    },
+    exec_compatible_with = ['//${pkg}/platform:value_foo'],
+    toolchains = ['//${pkg}/platform:toolchain_type'],
+)
+EOF
+
+  # Use the new rule.
+  cat >> ${pkg}/demo/BUILD <<EOF
+load(':rule.bzl', 'sample_rule')
+
+sample_rule(
+    name = 'use',
+)
+EOF
+
+  # Build the target, using debug messages to verify the correct platform was selected.
+  bazel build \
+    --experimental_exec_groups \
+    //${pkg}/demo:use &> $TEST_log || fail "Build failed"
+  cat bazel-bin/${pkg}/demo/use.log >> $TEST_log
+  cat bazel-bin/${pkg}/demo/use_extra.log >> $TEST_log
+  expect_log "hi from use, toolchain says foo"
+  expect_log "extra from use, toolchain says foo"
+}
+
+# Test basic inheritance of constraints and toolchains with a target.
+function test_exec_group_target_constraint_inheritance() {
+  local -r pkg=${FUNCNAME[0]}
+  mkdir $pkg || fail "mkdir $pkg"
+
+  write_toolchains_for_exec_group_tests
+
+  # Add a rule with default execution constraints.
+  mkdir -p ${pkg}/demo
+  cat >> ${pkg}/demo/rule.bzl <<EOF
+def _impl(ctx):
+    toolchain = ctx.toolchains['//${pkg}/platform:toolchain_type']
+    out_file_main = ctx.actions.declare_file("%s.log" % ctx.attr.name)
+    ctx.actions.run_shell(
+        outputs = [out_file_main],
+        command = "echo 'hi from %s, toolchain says %s' > '%s'" %
+            (ctx.attr.name, toolchain.message, out_file_main.path),
+    )
+
+    out_file_extra = ctx.actions.declare_file("%s_extra.log" % ctx.attr.name)
+    extra_toolchain = ctx.exec_groups['extra'].toolchains['//${pkg}/platform:toolchain_type']
+    ctx.actions.run_shell(
+        outputs = [out_file_extra],
+        command = "echo 'extra from %s, toolchain says %s' > '%s'" %
+            (ctx.attr.name, extra_toolchain.message, out_file_extra.path),
+    )
+
+    return [DefaultInfo(files = depset([out_file_main, out_file_extra]))]
+
+sample_rule = rule(
+    implementation = _impl,
+    exec_groups = {
+        # extra should inherit the toolchain, and the exec constraint from the target.
+        'extra': exec_group(copy_from_rule = True),
+    },
+    toolchains = ['//${pkg}/platform:toolchain_type'],
+)
+EOF
+
+  # Use the new rule.
+  cat >> ${pkg}/demo/BUILD <<EOF
+load(':rule.bzl', 'sample_rule')
+
+sample_rule(
+    name = 'use',
+    exec_compatible_with = ['//${pkg}/platform:value_bar'],
+)
+EOF
+
+  # Build the target, using debug messages to verify the correct platform was selected.
+  bazel build \
+    --experimental_exec_groups \
+    //${pkg}/demo:use &> $TEST_log || fail "Build failed"
+  cat bazel-bin/${pkg}/demo/use.log >> $TEST_log
+  cat bazel-bin/${pkg}/demo/use_extra.log >> $TEST_log
+  expect_log "hi from use, toolchain says bar"
+  expect_log "extra from use, toolchain says bar"
+}
+
+run_suite "exec group test"