Compliated permissions setup or use multiple collections?

[hgrimelid]

Hi, I'm building a site for an organization that have multiple departments (>10). Each department will have their own editors and writers with different publishing permissions.

Editors and writers have per department permission groups. Writer can create but not publish, editor can write and publish. An editor can have access to multiple departments.

In addition I want the editors/writers only see entries belonging to their department(s).

All departments will have pages, events and news.

I've started with an approach similar to this, where each entry get an owner group and entries will be filtered in collection view showing only those assigned to the group(s) the user is a member of.

But the more I think about it, the more complicated it gets. I need to handle both the admin filter view, the tree view, handle policies for update/create/etc. The writer should not be allowed to set the entry owner group, so this has to be set automatically based on the group the user is member of.

So, therefore I started to wonder if I could just create separate sets of collections for each department. Example:

Department 1
- Events
- News
- Pages

Department 2
- Events
- News
- Pages

Then I can use the built in permissions without resorting to hacks like described above. And my question boils down to whether this approach is a bad idea, any caveats I should take into consideration? Open to any suggestions :)