I have a business requirement to show all records of a custom object to all users except for a small group called 'reviewers'. This requirement runs against the grain of standard SFDC sharing, so it's not straightforward to support.
One approach is to add all users except the reviewers to a public group Show and the reviewers to a public group Hide. The size of our org necessitates automating membership of Show.
It's easy to add members on user creation and deactivation by using a trigger on the User object. But I also need to remove users from Show if they are added to Hide. It does not appear possible to write a trigger on GroupMember to do this: Group and GroupMember do not appear in the SObject list when creating a new trigger in the developer console.
What would be other approaches to meeting this requirement?