add permissions on sub-group creation