bring back principals (users and/or groups), though note this breaks most of the stuff that looks at direct reviewers and doesn't follow the pointers to group members