Wading into more complex User/Group/Asset logic now.