Putting a person in the wrong group is nothing you can mitigate against in software. A human chose to put them in the wrong group, the human should not have done that. The computers can only do what they're told.
The suggestions are all around process - record and audit all requests for user changes. Lock it down where you can (although there's not a lot you can do with the internal directory - you have to trust your admins to get it right). Regularly report on permissions and who has them. And make sure your admins are a small team, well trained, well educated on the risks of getting it wrong (and understanding it IS their fault if it fails), and they collaborate tightly.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.