...
Here is an example of adding and testing a rule with the grouper client, which is a command line client that you can use if you have WS access. This is the group intersection rule where you have to be in one group (e.g. employees) to be in another group (e.g. app users). If you fall out of employee, you will fall out of users. A nightly daemon cleans up inconsistencies.
...