use an operations group instead of sudo