Actually @joshcooper could I get some clarification on Puppet best practice around this?  Should all existing users be added, and the cumulative errors be rolled up to a single error *after* the group has been modified to include the existing users?

This seems like the most desirable from a user standpoint, but not sure if Puppet takes a non-deterministic stance when encountering such situations?