Sure, but when I run a command, why doesn't it check my group membership *at that time*, not simply at login? That appears to me to lessen security, not improve it: it lets me start new process with group settings that are now wrong.