The Role objects don't modify the user, either. Calling `user_set.add` implictly marks the data as dirty. No call to `save` on either the `Group` or the `User` is needed.