Just to add, because of ACLs we almost need a default category and a default category override based on primary group.