Under certain circumstances (a petition is finalized, a CO person flips between an active and inactive status), it may be necessary to reprovision multiple group memberships, not just the person record. For deployments where Registry manages a large number of groups, or groups with large numbers of members, it may be desirable to optimize the provisioning rather than rewrite in full each group the person was a member of.

One way to handle this would be to provide a special status to the provisioners with a CO Person ID and a list of groups. The provisioners could then perform add / delete member operations rather than rewrite the entire group.