Thanks,
David
We are also heavily using roles, but here the problem is guaranteeing that users have the same ids on all pillars, otherwise we risk users belonging to the wrong groups in production
I have found a work around to the insert problem by reserving a range of user records and doing updates instead of inserts; also not a clean solution.