Hierarchical groups (groups as members of groups) would have the additional advantage of automatically removing members from inherited groups.
To implement such a feature “by hand”, you would have to remember whether a group membership was inherited by a hierarchically higher group or set directly.
Could you comment on using an external user directory service (ldap) to implement a hierarchical group function?