Access based on role and additional user-level assignment

Local install so no link available…

I’ve been fiddling around with the settings and I’m comfortable with allowing certain roles to upload, some to read only, but I can’t seem to get my ideal outcome as I believe I need another level of user role, and unsure whether the plugin can support what I need.. let me try to explain what I’m after in more detail to make sure this is the right plugin for me (and if not, any suggestions would be great).

User Definitions

User – 1
Role – Manager
“Group” – A

User – 2
Role – Staff
“Group” A

User – 3
Role – Staff
“Group” – B

User – 4
Role – Director (or I guess, Administrator)
“Group” – C

User Scenarios

User 1 should have:
– no access to “Director” documents
– all access “Manager” documents in “Group A”
– all access “Staff” documents in “Group A”
– read only access to “Group B” or “Group C” (ie, not their assigned “Group”)
– read only access to “User 1” specific documents

User 2 should have:
– no access to “Director” documents
– no access to “Manager” documents
– read only access to “Staff” documents in “Group A” (ie non-user specific documents in their assigned group)
– read only access to “User 2” specific documents

User 3 should have:
– no access to “Director” documents
– no access to “Manager” documents
– read only access to “Staff” documents in “Group B”
– read only access to “User 3” specific documents

User 4 should have:
– full access to everything (which is fine, easy to do)

Overall Idea

The general idea here is not for collaboration on documents (understand this is one of the points of the original plugin).

The idea is that the “Manager” role is responsible for managing documents within their assigned “Group”.

The “Staff” role is there to allow these users to see their assigned documents, for example their company contract (user specific) or group policy/fire safety info (department level aka “Group”).

I thought I’d be able to use “Department” which is built into the plugin, but I need to be able to tie a users to a specific department (“Group” in scenarios above), which I don’t think I can do.

I could see this working by having “Group A Manager”, “Group A Staff”, “Group B Manager” as the roles, but that’s not the best way to work around this as the groups and roles are much larger than the few examples given. Also I’d then need to assign user’s ownership of documents which I then can’t seem to block them from editing (read-only).

I have been trying the “Members” and the “Simple Taxonomies Refreshed” plugins, with no avail.

Thanks for any guidance and information.