What are "paired groups" used for in conjunction with admin override?