The hierarchy is completely based on the subgroup expression at the top level, which can contain multiple items comma separated. The last subgroup will display aligned when there is a result as it's the final point of evaluation of the expression.
Create session subgroups - ConnectWise

The forum referenced in this post has been completely disabled, and are being migrated to the virtual community:
Home - ConnectWise

Please be aware that CW-SSO login credentials are required.

Thanks for your report.  I have discussed this with our architecture and information security teams and we agree we should find a way to make the toolbox behavior more predictable and clear especially when it comes to the required permissions. We do require the RunCommandOutsideSession permission to be able to run a tool from the host page, but not from the host client. we also have documented that the shared toolbox requires the TransferFilesinSession permission, and will make sure that we update this for the personal toolbox as well.

note: edited for a typo and clarity

This is something we are currently working on and hope to release in Q4. f you are interested in being a beta tester please shoot an email to ctrlpm@connectwise.com.

(anyone interested can do the same :) )

Hey Dallas,

Can you please share the number of machines you interact with that have this requirement, the specific Windows OS, smart card provider, type of host connection (Access or Support session), and how you currently connect to these machines, I can get this in our backlog for future consideration.

Thanks!

Hello,

Control has the ability to integrate with Okta as described here: Set up Okta SAML - ConnectWise

Unfortunately, your scenario would not work out of the box. If the machines had a note or some other common field they could be grouped and then you could execute the command. 
That said, this may be possible with a custom extension and if it's something you will be doing often, it may be worth your time to create one, here are details on that program:

Create a private extension - ConnectWise

requests for a developer license must be sent to ctrlpm@connectwise.com.