Add a permission that allows roles to create sub requests on behalf of other users