If you manage subpartners, you first must assign the Content Shield service to the subpartners who should have access to the service. Only then can the service be activated by either you or the subpartner.
Then, a Master Partner can activate the Content Shield seats to either their own accounts, and/or directly to the accounts of any subpartners being managed. If activation is done directly to the account of a subpartner, it is then also automatically assigned to that subpartner.
After a Content Shield is assigned, a subpartner also can activate the account directly. See Activating Seats to Accounts.
Also see: Unique IDs