Hmm, that seems orthogonal to me. I also have the ability to ask "is user Joe a member of group Foo" at any time. I just can't enumerate groups and users.