UpdateMember writes the fields the patch carries and no others, and this is where most administration of a member happens: disabling a member so they can no longer sign in or reach the space, and marking them unofficial so they are left out of official rankings, are patches rather than methods of their own. Disabling can be immediate or scheduled through separate fields — a scheduled deactivation never raises the inactive flag, although a read still reports a member outside their active period as inactive. Identity details of a member owned by an external identity provider cannot be changed here: carrying one is refused rather than ignored, so a caller is never told a write succeeded when nothing was written. A member can belong to at most 10 groups, and a patch that would take them past that is rejected with InvalidArgument on the groups argument.