Follow up to my question here, how would you solve the problem of deactivating one of these objects, either group or user? I could of course delete the object and remove all of its relationships, but then if I wanted to reactivate it I'd have to resync all the permission back again. Is this the recommended way to solve this problem?