With the 0.5 release candidate and earlier if I grant a user 'create hostgroup' on a filter of host groups e.g on

/base/castor

then they can create a new host group

/base/castor/whatever

I think it seems sensible to me that the user filter should be extended to cover this new subgroup
as well /base/castor/whatever as well.
e.g having created /base/castor/whatever they might also be able to create /base/castor/whatever/andthis also but
genrally for other permissions for create host, delete host , .. whatever.

Alternatively a filter of

/base/castor

could actually mean /base/castor and /base/castor/* either always or optionally.