Let’s take a very small sample from a familiar company. In parenthesis are the users who should have access.
Time Warner Inc (Barb, John, Brian)
HBO Division (Jessie, Barb, John, Brian)
HBO (Michelle, Jessie, Barb, John, Brian)
Cinemax (Tom, Jessie, Barb, John, Brian)
Turner Broadcasting System (Jeff, Barb, John, Brian)
Turner Entertainment Networks (George, Jeff, Barb, John, Brian)
truTV (Percy, George, Jeff, Barb, John, Brian)
When permissions are set at Time Warner Inc, all sub-Advertisers will take on these same permissions.
Barb, John & Brian are responsible for Time Warner as a whole. Therefore, they should have access to all things Time Warner Inc. By adding them as users at this level, they will automatically have access to all sub-Advertisers under Time Warner Inc.
From there you can add users at the various levels based on which Advertisers they should be able to access.
Jessie oversees all of the HBO division properties. She would be added as a user at the HBO level & be able to access all HBO sub-Advertisers (HBO, Cinemax, etc). She would not have access to anything within Turner Broadcasting System.
Tom is responsible for Cinemax. Adding him at this level will limit his access to just Cinemax.
When you move Advertisers, they keep their existing permissions & add the permissions of the parent Advertiser.
Let’s say HBO moves to CBS, which can be accessed by Peter. When you move HBO to CBS, Barb, John, Brian, & Jessie will retain access to this Advertiser. It will also add Peter, since he has access to CBS.
You can always adjust permissions as needed by adding & removing user access.