add a groups_mode switch between require/exempt