Support virtual attributes and subgroups checking users' membership.