No entity permissions defined for related group types

The path /group/[group ID]/subgroup/create is requiring create ggroup:[group type plugin ID] entity permission. Only admins can pass that requirement. This applies even though the user has access to /group/[group ID]/subgroup/create/[subgroup type].

It is a group module restriction.
It doesn't allow to provide entity access for group types.

https://git.drupalcode.org/project/group/-/blame/3.3.x/src/Plugin/Group/...

I am checking it, what we can do

More info: https://www.drupal.org/node/3279234 →

@brad you can still assign permissions to edit/delete group on subgroup type level

It's specifically the lack of create permission that we were hitting - group editors don't get the button to create new subgroups. Even if that user has a Drupal role granting create access on that group type, they get an access denied error on the link that would appear in the button. If we display the actual ultimate path for creating the subgroup, the people with Drupal permission can use that. So far there doesn't seem to be any way to give a group member access to create subgroups of that specific group only.

Did you provide your editor roles permissions to create this Group type ?
I was able to create an example:
1) Editors can create a subgroup, because we provide rights to manage Subgroup relationships
2) Editors can edit/delete group, because we provide rights for specific group

it's #1 that doesn't work. what permission are you granting? they can create relationships but that only allows them to add an existing group as a subgroup.

we want to give a member of ParentGroup A permission to create groups of type ChildGroup as subgroups of ParentGroup A and only those. not to be able to generically create a free-standing group of type ChildGroup, not to create any subgroups of any other ParentGroup.

at the moment the only thing we can do is grant the global Drupal permission to create ChildGroup entities to a Drupal sitewide role. even with that, the Create button isn't visible to them on the Subgroups tab, because they don't have the "create ggroup:etc" permission described in comment #1 (that path is the Create button path)