From the official Google Apps blog…
Google Apps administrators can now segment their users into different organizations and control which Google services are enabled/disabled for each of those different sets of users.
- Allows creation of organizations in a tree-like hierarchy
- Manage membership of users into one organization
- Specify policies for which services are on/off by organization
Updates have also been made to the Google Apps Directory Sync Tool and the Provisioning API to take this new functionality into account.
You can read more about this update here: http://googleappsupdates.blogspot.com/2010/07/user-policy-management-now-in-google.html
One last thing…there is a catch to using this. A user can exist in only a single node in the hierarchy tree. This could present problems for users who have multiple roles (ie. a graduate student who is also an undergraduate alumnus, a staff member who is also a student, etc.)