this will fail hard if the user belongs to multiple groups (which is probably likely). is that the right behavior?