Brought to you by Novalys
In the default Visual Guard data model:
Up to VG 2017, when a role was granted to a group, it was always propagated to all sub-groups.
With VG 2018, role propagation is optional: