User has two roles for OpenDJ: the first is the basic role, which constructs the account and also puts user to some groups. The other group is meant to be assigned to get some additional group membership.
Changing Activation parameter for the assigned role does not remove user from the group.
This perhaps means that validFrom/validTo dates on assignment would be ignored as well...
Enforcement policy = relative.