The entry records the issuer of the command as the group's creator, and as the group's owner unless the -owner argument names an alternate user or group as the owner. The part before the colon names the group's owner.
Any user can create such groups.
Creating a group lowers the issuer's group-creation quota by one. This is true even if the -owner argument is used to assign ownership to an alternate user or group. Although using the -owner argument to designate a machine entry as a group's owner does not generate an error, it is not recommended. The Protection Server does not extend the usual privileges of group ownership to users logged onto the machine. If the -owner argument names an alternate AFS user, the field must match that AFS username.