this req seems to contradict was what removed in the above paragraph "Unless used in the aforementioned 3-legged OAuth workflow, a Group MUST NOT be used to assert authority."