I looked at the group module. Defining permissions based on user and entity memberships would suit my needs very well, but sometimes I would need a combination of various group memberships to define if a user is able to see an article.
Example:
There are two group types: site and department.
The user is a member of the group "Paris" and the department "sales". The article is a member of both groups as well.
The user should only see articles which are member of BOTH groups. He should not see the articles which are member of the group "Paris", but not member of the group "sales".
Is this possible?