A user who has the appropriate security role and the required visible and write privileges for a folder can create a subfolder in that folder. The user that creates a folder can assign access privileges to that folder for other users or groups.