...
When it comes to memberships, the one thing we need to keep in mind is that the Grouper SubjectID may not be the end-user's ID in the target system. This will necessitate a potential lookup in either grouper, the source of the grouper subjects, or some other translation table.
Privilege Add/Update/Delete
Like Membership updates, callbacks may be necessary here to perform the SubjectID end-system ID translation