Security

Hi, generally I would say, this is what testing is for, to root out potential errors in the system such as this. The easiest solution to this may be a dashboard which flags users which are in both groups visually. In such a case, the admin would need to check the dashboard after users have been added. But that may only be worth it if you are talking about a large number of users.

The way to go about it when we are talking about small changes may be to just look at the newly created user and check if the user is in fact only in one of the respective groups.

If this is all not satisfying, one might investigate whether event handlers such as WCF can be used to catch saving changes to users and return an error in case someone tries to save an undesired user group combination.