Syscom and office staff should have special local privileges (audio, adm, etc.). weo should be updated to special-case these group adds/removes.