Any way to programmatically add to groups?

Yes, that’s Plan B, but possibly with LDAP groups…