Reported by Ilya Baldin:

1. I add a role to a person. I see the members:all and members:active groups membership materialize on them for that role
 
2. I delete a role. I see the group memberships go away
 
3. I add a new role and I see new group memberships get added
 
this is good. Alternatively, I try to short-circuit 2-3 into an edit step
 
1. Add a role to a person
 
2. Edit the role, change the COU to a different one
 
Now the person has old role group memberships and new role group memberships and I can’t remove the old group membership (checkboxes are greyed out for members:active and members:all even though that role is no longer valid).