gotcha. So all users can be part of

member

group and banned user is part of

banned

group. Then access permission is

group#member - group#banned

?