[Building Sakai] Prevent 'group provider' enrollments from being deleted?

[Kevin Pittman]

When we were running Sakai 2.5, I'm almost 100% certain that users in
a role set to be 'limited to the group provider only' on the realm could
not be deleted from that realm's worksite by an instructor (or anyone
else, for that matter.)

I just dicsovered with Sakai 2.8 that while the 'limited to the group
provider only' setting still prevents the instructor from changing an
enrolled user into or out of that role, the instructor can now delete
the user from the worksite.  Obviously, this is not what we want for our
official academic courses, where student enrollments are controlled by
our Student Information System, and I've now run into a problem where an
instructor has tried using this method to turn a student into a teaching
assistant (which isn't allowed under our school's rules.)

Is there a simple way to restore the 2.5 functionality and prevent an
instructor from being able to remove a user who has been enrolled in a
worksite under a role controlled by a group provider?  I've done some
cursory searches for an answer, but haven't been able to find anything
relevant yet.

Thanks,
Kevin
Georgia Tech Sakai Systems Administrator

-- 
Kevin Pittman                              kevin.pittman at oit.gatech.edu
-----------------------------------------------------------------------
Senior Systems Support Engineer        Office of Information Technology
Academic and Research Technologies      Georgia Institute of Technology