Group rules for DLP Endpoint

Hello All,

How do you manage user group rules in DLP endpoint.

For example, if you want to create a policy to detect incidents of copying sensible information on USB,

how can you create a rule for all of your agent installed ? do we need an Active Directory group with all users ?

How can we manage users movement (leave, hire, tranfer ...) ?

And how can we manage with different entities which has differents security level ?

for example, a entity A will say that all users have USB blocked unless there are on an AD group,

an entity B say that all users have USB open there are on an AD group.

Thanks for your answers

Regards.