can now add and remove entries from the group permission template idempotently