We have a multi-app multi-site app structure like follows:
Commerce BE Pages Feature 1 Feature 2 DE Pages Feature 1 Feature 2 NL Pages Feature 1 Feature 2 Business BE Pages Feature 1 Feature 2 etc
So we have different apps and every app has multiple country sites. We have defined a role per country per app, so we have the roles Commerce BE, Commerce DE, Commerce NL, Business BE, Business DE etc. These are access roles in the sense that they have access to the appropriate location in the content tree.
The problem now comes when we want to add an additional layer, namely for specific features. We would like to define the roles Feature 1 Admin, Feature 2 Admin etc. And users should only be able to edit a Feature subtree when they have rights to the country within an app AND have the appropriate feature role. The problem is that when you break inheritance for a feature template and assign rights to the template, a user who has the feature role, can now (theoretically) edit the feature subtree of other countries! Ok, the user would not see the content of other countries, but in the access viewer we see that the user has rights to the feature subtry of countries that he has no country role for.
How could we solve this problem?