nested group memberships (grp->mem) not unique