Tracking bug for LDAP change. cfengine.git commit ef334c402 Permits recruiters to ADD gentooAccess=recruiters.group to any dev. Does not permit removing that bit (so cannot have "rogue recruiter" removing access).