Department is... rule now works. LDAP sync will remove erroneous affiliations.