This is a crazy-pill idea.
Imagine if all non-owner group changes must carry a special token issued by the owner. All memebers get such a token when they are invited to a group. This token carries information about their permissions in the group: which subpaths can they publish, whether they can publish at all, etc.
Owners can revoke tokens when members are removed from the group.
Owners can reissue tokens to expand their permissions if necessary.
The benefit is that member management is consolidated under the same entity, and you won't end up with weird situations that you can often get into when you manage permissions in Linux filesystems for example. That's one of the main argument in favor of OCAP in general.