narrow membership scope for GroupRole and GroupMembership to just Agents