The `user` type has a `membership` parameter that controls this. It defaults to `minimum` meaning make sure the user belongs to at least the groups specified. If the `membership` parameter is set to `inclusive` it means make sure the user belongs to only the specified groups.

The `group` type has an `attribute_membership` parameter which functions similarly, but for some strange reason, it is only for managing the AIX `attributes` property. As a result, you could shoot yourself in the foot by removing a user from the group you didn't mean to. Ideally, the `group` type should have a `membership` parameter that determines how its `members` are processed, but since it's been that way for a while, I'm not concerned.