Permissions / Roles / Taxonomy / Workbench -- combination?

Question

Hello dear Drupal enthusiasts,

I'd like to hear your opinion - how to organize mentioned modules/functionality to achieve nice permission granularity.

1. After user is logged in we have a list of his e-groups (outside structure, we have its names).
2. I want to build drupal inner hierarchy where I organize user e-groups to tree structure.
3. I would like to divide nodes to groups, to allow people who are members of some e-groups to edit some nodes (gathered in group).

What comes to my mind it's to organize page structure in one vocabulary, and allow admin to add a e-group name to some taxonomy.

Example:

• Main Site admin [taxonomy: egroup-main]

  • Department A admin [taxonomy: egroup-department-a]

  • Group 1 [taxonomy: egroup-group-one]

  • Group 2 [taxonomy: egroup-group-two]

    • Subgroup 1 [taxonomy: egroup-students]

  • Group 3 [taxonomy: egroup-group-three]

And now, after somebody logs in first time, and we know he is part of egroup-main, we give this user taxonomy egroup-main, which is the same we set to Main Site Admin term in vocabulary shown in example.

1. Is there any better way to organize this? I need fine, good grained control over users by egroups, to access, create and delete nodes.
2. What about workflow management? I mean - module like Workbench is nice to control workflow, let beginner users to edit, and let admins to publish stuff after review.

I know there's a module called Taxonomy Access but it seems it bases on Drupal Roles which means apart from taxonomy we would have to create dynamically user roles (depending on e-groups), attach permissions to them and assing users to these roles...

Waiting for your hints people!

Confused Drupal developer

Answer 1

http://tutr.tv/t4991?list=4948 is a video from Drupal Con London where they talk about the Workbench Modules and will answer most of your questions/concerns.

If you have Workbench Moderation you can have users submit content for review. Then a content moderator will publish the content or return it as a draft for changes.

Workbench Access will limit users to what content a user can create/edit. You just need to create a role, assign the role to a Workbench Access Section of the site, and then when they create a new account you can assign them to the correct role.

I have this on my site and have created a rule to email me whenever someone logs in for the first time so I can assign them a role.