I have a Sharepoint 2013 server farm. I am trying to create a multi-tier site collection for our QA documentation. Here is my situation.
On my TopLevelSite(TLS). Only the site admin and a few support staff have access. Everybody else has only view privileges. I assign the admin and support staff to the owner group, and every one else to the visitor group.
My TLS has 3 sub-sites (A,B,C). I break inheritance here. The manager for A,B,C departments are assigned to the owners group. Everyone else in department A will be assign to the visitors group, and vice versa for department B and C.
Now here is where my problem begins. In Sub-site A. There will be a few dozen small units. Each having its own sub-site. However the structure of these units are the same. One contributor, 3 approvers, some visitors and those not in the unit has no access at all. Again I break inheritance and created groups for contributors and approvers. I created a workflow to route documents for approval by the 3 approvers. Make this a template and copy over for the other units.
The problem is that person X can be a contributor for one unit and an approver for another or only can have view access, or no access at all. If I assign person X to all the groups he will have access to all the units, even units where he should not have approver privilege. How do I assign the permission this way so that I do not need to create unique named groups for each unit and modify each individual workflow?