Is there any danger into letting a sub site manage their own permission levels? For example, a sub site that will be by itself and used by a separate group that will need to create custom permission levels.
I'm not entirely sure the ramifications of giving the sub site's admin the ability to break inheritance of permission levels and create their own.
Thanks for any advice.
There should not be any danger in disinheriting the permissions of a subsite from its parent site. Make sure that it is properly governed - who can do what in the site and subsite.
Creating custom permission levels for sites or subsites are a common practice. Breaking the inheritance only separates the subsite on permission perspective from its root site. Rest all dependencies remain the same.
You can break permission dependency, not only at site level. This can be done for any library, list,etc within a site. Visit this msdn post for more clarity.
Keep in mind that at any time, when you re-inherit back to the parent site, the unique permissions that you had applied to the particular site will be reset.
It can be very confusing that groups are always defined at the Site collection scope and site collection admins always has rights to everything
Usually you get the best result by splitting arears with different permissions into different site collections, as it gives a cleaner security model but navigation becomes a pain
As always it depends on what you want to do
