Maybe the standard group membership UI? (That could of course be improved, but that's another topic)
This will create a bunch of 'special groups', per subsite I guess, no? Where and how will they be maintained and identified?
