I have sitecore setup with 30 + site nodes ( site-Australia, site-Germany, site-Japan ,site-US etc.) in Sitecore. At present all editors and publishers have access to all of these nodes which in practical not an ideal design.
We want to restrict the access to editors and publishers in such a way that , Australia editor can not edit or see the Germany site node items, similarly US editor can not see or edit items in Australia or German (or any other) site nodes.
As a solution, I created region wise editors and publishers ( Auseditor, Japaneditor ) and allowed read,write, create, rename and inheritance access to that region node and denyed the write access to other nodes. This works fine with individual editors.
Now issue I am facing is , there are editors who need access to 2 or more regions (for eg. ASIA editor who needs access to Australia, Japan nodes) and in that case, since the deny takes the priority over grant, when I add both the roles, that editor is not able to write the content as Japan node denies write access to Australia node and Australia editor role denies the write access to Japan.
The solution I thought for this is to create another role for such "combined" editor roles and give the write access to these multiple nodes. But not sure this is right approach for access rights for multi node solution as we have many nodes and I suspect that we may end up managing such "combined" scenarios as and when required in future which may make the role management tedious and cumbersome. So looking for some simplistic solution thoughts for this design.
If you have come across the situation and have better suggestion/solution please do share.
