I want to set up a site which distributes information worldwide in a company.
There shall be at least 3 groups of users, according to their permissions:
Group 1 which shall have the right to see everything on this site
kind of administrators/managers for the site
Group 2 shall have the right to see nearly everything on the site.
Group 3 shall have restricted access - they shall not see internal/confidential information.
For me the most natural approach would seem to define a metadata field which shows the restricted access like "public" / "internal" / "admin only". However, if I understood it correctly, it is not possible to use such a metadata field to entirely hide a document before a user, as at least users could define custom searches to display such hidden documents as search results, even if they do not have the user permission to open the document.
The second approach would seem to define which user group(s) have access to a document for each document individually. However, I heard that this can lead to performance problems if a critical threshold of about 1000 documents with individual access permissions is exceeded.
What's the solution for this problem?
Creating a directory in the document library, which can only be accessed by group 1+2? (for the information which shall be hidden from group 3)? But then, what happens if a file from this directory is linked in a wiki page or in another document? At least here people from Group 3 will be able to see that it exists.
A second aspect: Is it possible in a wiki or discussion forum to have to types of elements next to each other - and one of them can not be seen by a certain group of users?