This works in the following circumstances:
* client is deleted
* client is modified
* client has role added
* client has role removed
* group is deleted
* group is modified
* group has role added
* group has role removed
* group has client added
* group has client removed
* anonymous group is changed
The following circumstances are not yet fixed:
* role is deleted
* role is modified
* role has ACL added
* role has ACL removed