Allow users to specify allowed groups in the env and use it to inspect the claims. This performs a logical AND of users and groups (additive).
Peter Olds