In some cases, a sub-account should restrict access to a single group and all its children. For example, if an account manages data for several different end customers, it could contain a top-level "Customer" group, under which all data for that customer is stored; obviously, a user from one end customer should only be able to access data for that Customer group.
Alternatively, a single account could manage a number of different facilities, and the manager of each facility has a user profile that should only be able to access data for that facility. If this is the case, where a certain group type will always correlate entirely to a sub-account, an account supervisor can automatically link groups of that type to sub-accounts by clicking on the "Sub-Account" checkbox for that group type on the Model > Group Types page.
If this flag is checked, whenever a new group record of this type is created, the system will automatically create a corresponding sub-account containing only that group. In the example shown below, the three listed instances of the linked "ParentGroup" group type have been created, and the system automatically created three sub-accounts containing each; the custom logos were added afterwards to distinguish them from the rest of the sub-accounts. To create the name of each sub-account, the system tacked an asterisk onto the end of the Key of each group.