diff --git a/src/gl-compile-conf b/src/gl-compile-conf
index 281eafd..8f97bf0 100755
--- a/src/gl-compile-conf
+++ b/src/gl-compile-conf
@@ -121,7 +121,14 @@ sub expand_list
 
 sub parse_conf_file
 {
-    my ($conffile) = @_;
+    my ($conffile, $fragment) = @_;
+    # the second arg, $fragment, is passed in as "master" when parsing the
+    # main config, and the fragment name when parsing a fragment.  In the
+    # latter case, the parser uses that information to ignore (and warn about)
+    # any repos in the fragment that are not members of the "repo group" of
+    # the same name.
+    my %ignored = ();
+
     my $conf_fh = wrap_open( "<", $conffile );
 
     # the syntax is fairly simple, so we parse it inline
@@ -142,7 +149,9 @@ sub parse_conf_file
         # user or repo groups
         if (/^(@\S+) = (.*)/)
         {
-            do { $groups{$1}{$_} = 1 } for ( expand_list( split(' ', $2) ) );
+            # store the members of each group as hash key.  Keep track of when
+            # the group was *first* created by using $fragment as the *value*
+            do { $groups{$1}{$_} ||= $fragment } for ( expand_list( split(' ', $2) ) );
             # again, we take the more "relaxed" pattern
             die "$ATTN bad group $1\n" unless $1 =~ $REPONAME_PATT;
         }
@@ -174,6 +183,22 @@ sub parse_conf_file
             # ok, we can finally populate the %repos hash
             for my $repo (@repos)       # each repo in the current stanza
             {
+                # if we're processing a delegated config file (not the master
+                # config), and if that fragment name is not the same as the
+                # current repo
+                if ($fragment ne 'master' and $fragment ne $repo)
+                {
+                    # then the fragment must be a group name and the repo
+                    # being processed must be a member of that "@group".
+                    # Also, the value of the hash for that combination must be
+                    # "master", signifying a group created in the master
+                    # config file and not in one of the delegates
+                    unless ( ($groups{"\@$fragment"}{$repo} || '') eq 'master')
+                    {
+                        $ignored{$fragment}{$repo} = 1;
+                        next;
+                    }
+                }
                 for my $user (@users)
                 {
                     $user_list{$user}++;    # only to catch lint, see later
@@ -195,9 +220,25 @@ sub parse_conf_file
             die "$ATTN can't make head or tail of '$_'\n";
         }
     }
+    for my $ig (sort keys %ignored)
+    {
+        warn "\n\t\t***** WARNING *****\n" .
+            "\t$ig.conf attempting to set access for " .
+            join (", ", sort keys %{ $ignored{$ig} }) . "\n";
+    }
 }
 
-parse_conf_file($GL_CONF);
+# parse the main config file
+parse_conf_file($GL_CONF, 'master');
+
+# parse any delegated fragments
+wrap_chdir($GL_ADMINDIR);
+for my $fragment_file (glob("conf/fragments/*.conf"))
+{
+    my $fragment = $fragment_file;
+    $fragment =~ s/^conf\/fragments\/(.*).conf$/$1/;
+    parse_conf_file($fragment_file, $fragment);
+}
 
 my $compiled_fh = wrap_open( ">", $GL_CONF_COMPILED );
 print $compiled_fh Data::Dumper->Dump([\%repos], [qw(*repos)]);