How to prevent a user from getting two usergroups.

Hi Kyle,
I have a group that has access to the backend community builder to add new users. These are allowed to view only community builder so that they dont access stuff that I do not want.
I now have normal registered users, who have access to everything but NOT to the backend.

I can see the problem though that someone will edit their own user in the backend and add them the group of the normal registered user. How can I prevent this?

You can't unless I guess you force usergroup assignments with CB Auto Actions acting on the after update user trigger. So for example if you've an auto action with usergroup type and you set access to your backend usergroup you could set it so if you save them it always reassigns the backend usergroup, but then you can't demote users. It maybe possible to condition them to see if they're trying to add Registered though. What issue is this causing exactly? Adding Registered shouldn't give them more backend permissions.