Pick a unit type, then the specific units it contains. Units that fall outside the assigned roles' scope stay selectable but are flagged inline, so the admin sees the mismatch at the moment of choice rather than after saving.