When you create a user, you are only providing the system with a name and password for the user entity, which can be either a person or an application. A user can belong to only a single permission group. Only the admin user can create or modify a user profile. Every user who is included in a group has all of the access privileges granted to that group. Only the admin user can create a permissions group and assign or modify privileges.
Permissions descend downward from the topmost domain in which the group has rights.
If the permission group is granted permission to create domains in domainA , users in that group automatically gain the right to create subdomains in any of the domains that exist within domainA . If the permission group is granted permission to delete domains in domainA , users in that group automatically gain the right to delete any domains within domainA . Once a domain has been created, however, the administrator can change these inherited permissions. When the administrator creates domains, for these domains to be useful for nonadministrative users, the permissions create, read, and modify should be granted. Create permission is necessary for domain creation, read permission is required to get the content of the domain, and modify permission is needed to assign the NEM server in the domain.