Tracking user groups changes

Hi everybody,

in our packages, we often use ram.cache and a particular check we do in the cache invalidation key is if user.getGroups changed. The problem is that user.getGroups is very expensive and we can not really cache it longer than for the current request because we do not know when it changed.

Is there a way to track user group changes? I do not see an event or anything like that. I would expect a PrincipalAddedToGroup/PrincipalRemovedFromGroup event in PAS or PlonePAS. Is there another easy way now to handle this?

Thank you,