Add per-subcollective access restrictions, using COLLECTIVE-admins/COLLECTIVE-servers group names