Keystone v3 improvements.

Managers for project group membership, project user membership, project combined membership (users and groups); for group project membership, group users, group roles; for user project membership, user roles.
As a side-note, that problem with transactionality is part of the reason I've kept it out of openclient where possible. There isn't one right answer that's appropriate for everyone.