Cool. Thanks Russell. When I get a change I'll take a look.
I want to emulate the traditional groups used with (Open)ACS, nsadmin and/or web, but groupadd isn't applicable to OS X (and neither are useradd or adduser). So I'm going to get acquainted with Netinfo and lookup real soon...