group and project membership gets messy over time. add a feature that helps identify redundant memberships, e.g. if a user already has project access by way of a group grant