eg: Parent COUs shouldn't be enrollable even though leaf COUs are. Probably do this via a status attribute at the COU level (that doesn't percolate down to child COUs).