I should also say that the roles feature was born at a time when the product was marketed for very large scale deployments. We had seen for example the mail server users attempt to create groups with millions of entries. That just didn't work at all well. That was then and this is now: the target market is somewhat different. For the typical F500 company with a few thousand employees, virtual view static groups are probably just fine.
