This better separates the concerns of preparing the sandbox namespace
from creating a (sub)group.