the distinction between membership and ADMIN OPTION makes sense as a general rule
I haven't worked through the details but I suspect part of the issue is that we are not maintaining this distinction when it comes to prohibiting circular dependencies. Might it be that we need to check for and prohibit the admin and the set/inherit loops separately, but allow for an overall loop so long as one direction is strictly admin and one direction is strictly set/inherit?
