sometimes, dynagroups simply aren't fine-grained enough to answer the query for what resources you want in a particular group.  to supplement this, we should support post-processing rules that execute after the dynagroups have been calculated from the expression set.  we need to define what these rules might look like, but at the very least we need rules for manually manipulating the result set - adding and removing specific elements.