I think this should be changed to still include superusers if the domain doesn't have the flag set. then i think it's g2g