To be able to avoid expensive uncached API calls in Admin UI to always have to load to see if a object is User or User Group, simply expose isUser() and isUserGroup() APIs on UserService to avoid this (as it can check against config instead).