`Membership.instance` is nullable in order to assign *non-instance* groups to users (e.g. global administrator).