[Freeipa-users] RBAC in FreeIPA: Conflicts while adding permissions to a role.

I am configuring RBAC in my current FreeIPA setup. There is a requirement wherein each host can only belong to a particular host group. If a host is already a part of some host group, a particular role which I create should not be able to add it to any other host group.

Let me clarify this with an example:

Let us say host1 is a part of hostgroup1. There is a role which has modify access to hostgroup2 (i.e he can add or delete hosts from this group). Can I restrict this role from being able to add hosts which already belong to some other hostgroup?