My site has roles for administrators, students, and teachers. Students create nodes, and each student has exactly one teacher. Teachers should be able to view all content created by their students, but no content created by other students. In other words, I'd like to have some kind of per-user setting that allows me to select one specific other user who can access the first user's nodes.
This seems like a pretty common situation, but I can't figure out how to do it. I'm open to any suggestions. Here are some things I've looked at so far:
I started out by using references to link each student to a teacher. However, I couldn't find a way to use that relationship for access control.
The subuser module looks appropriate, but I'm leery since the D7 version is still in alpha. Has anyone used it for this purpose?
Taxonomy access control looks like another possibility. The list of teachers is static, so it could be made into a vocabulary. But if Teacher is a per-student setting, is there a reasonable way to make that propagate down to the nodes created by that student?
Any other suggestions about how to do this?