OAK-9799 : Optional validator to mark external users/groups as protected (#604)