At Puppetconf you explained that you were having with some `exec` resources taking an unexpectedly long time, which was the rationale for this. While it makes sense it's a workaround, and I would rather fix command execution than include workarounds. Would you be able to expand command execution to run one `gpasswd` invocation per user instead of a shell pipeline? It will make this much easier to test and reason about.