Currently, organization owners and admins can simply place users as members of their organizations (or groups within those organizations) without those users' consent. While this is unlikely to have too many negative consequences, it would be better require both parties to agree.