That's why I'm a great fan of positive confirmation steps before such changes with possibly large implications. The whole change needs to be shown to the user with all changes marked and then you confirm once more that that is what you want and then that and only that gets executed. All these 'video game' interfaces with implicit saves and underwater API calls are super dangerous.

This is a great example for educating devs on the dangers of “set” operations vs. “pull/delete” in contexts where data can be edited concurrently.

I would say that the audit log was accurate, though, even though the bad UI design caused unintended consequences.

There is so much goofiness happening in those web portals (and also the New Portal, and the Legacy Portal) that issues like this don’t surprise me. Every time I click a button in there I worry that the wrong thing will happen to a different object. Sometimes the display reflects the worst possible outcome, like adding a user to a group will show you the new group membership as just containing that 1 new user and nobody else. Quite a few moments of panic.

That's crazy and a pretty good point.

The human in the loop doesn't really control what gets done, it only expresses intend to the frontend.