From time to time service groups are created in projects outside Tools; currently there are:

andrewtestproject.foo
bastion.deadlinkfinder
bastion.jybot
bastion.linktranslator
bots.admin
bots.asurabot
bots.chemobot
bots.cluebot
bots.coibot
bots.czarchivebot
bots.linkwatcher
bots.logs
bots.rezabot
bots.stemmeberettigelse
bots.unblockbot
bots.wmib
bots.xlinkbot
catgraph.catgraph
cvn.cvnservice
maps.maps
orgcharts.mongodb
rcm.cac
snuggle.database
snuggle.www-data
webplatform.test2

I assume that the existence of those service groups is not on anyone's radar when changes are made to how service groups are handled by Extension:OpenStackManager, Horizon & Co.

To avoid shell users creating service groups in the bastion project and maintaining awareness of the legitimate use of service groups elsewhere, Extension:OpenStackManager should have a white-list of projects where service groups can be created.