if you don't link the groups to the users, you'll need to do a check per group