Enforce only one membership per group and person