1. A method in a computing system for dynamically managing computer applications, comprising: receiving data containing application entitlements; receiving a plurality of group definitions, each of the group definitions expressing a group composition logic rule used to identify members of a group through evaluation of the group composition logic rule; evaluating the group composition logic rule of each of the group definitions to generate a plurality of data repository queries; causing the data repository queries to be executed against one or more data repositories to determine one or more tables that map users to groups and map users to the application entitlements; receiving a user generated change to a user and/or a group; and automatically propagating the change through the one or more tables that map users to groups and/or automatically propagating the change to the one or more tables that map users to the application entitlements.