Clarify subgroup CD authorization for K8s agent

doc/user/clusters/agent/ci_cd_tunnel.md

@@ -70,6 +70,7 @@ To authorize the agent to access the GitLab project where you keep Kubernetes ma
    ```
 
    - The Kubernetes projects must be in the same group hierarchy as the project where the agent's configuration is.
+   - You can install additional agents into the same cluster to accommodate additional hierarchies.
    - You can authorize up to 100 projects.
 
 All CI/CD jobs now include a `KUBECONFIG` with contexts for every shared agent connection.
@@ -92,9 +93,11 @@ To authorize the agent to access all of the GitLab projects in a group or subgro
    ```
 
    - The Kubernetes projects must be in the same group hierarchy as the project where the agent's configuration is.
+   - You can install additional agents into the same cluster to accommodate additional hierarchies.
+   - All of the subgroups of an authorized group also have access to the same agent (without being specified individually). 
    - You can authorize up to 100 groups.
 
-All the projects that belong to the group are now authorized to access the agent.
+All the projects that belong to the group and its subgroups are now authorized to access the agent.
 All CI/CD jobs now include a `KUBECONFIG` with contexts for every shared agent connection.
 Choose the context to run `kubectl` commands from your CI/CD scripts.