Access denied when editing item in custom list, but create works fine. What could be wrong?

Question

I've been trying to set up a list in which people in different departments in our company can create and edit their own items, read items from their own department, but not see items from another department. I have tried to achieve this by using folders with specific permissions. I thought I had it working, as people can create items, yet when they try to edit them, they get an access denied error. This is how I set the list up:

1. Created a custom list. Stopped inheriting permissions. Turned on "Create items and edit items that were created by the user" in advanced settings.
2. Created 2 sharepoint groups "IT" and "HR" each with the respective AD group as a member.
3. Gave these 2 groups read access to the list.
4. Created 2 folders called "IT" and "HR". Stopped inheriting permissions for these folders, and removed all existing permissions.
5. Gave Contribute and Read permissions for IT group to IT folder and the same for HR.
6. Created custom edit, create and view forms to manage the items.
7. Added a custom URL to the navigation menu to create items directly in the IT folder, and used Audience Targeting to show this link to IT people only. Did the same for the HR group.

Now, this all seems to work fine for creating and viewing items. After checking the "Show all items without folders" setting in the views, people don't see the folders, but just the items they have access too. When they click the create link, it goes to the custom "new" form, where they can create an item which is automatically placed into the correct folder so that other people in the correct group can see them too. This all works fine. However, when the owner clicks the edit link they get an access denied error. The funny thing is, only the owner gets the edit link ... other users who can only read (because they didn't create the item) don't get this link. So the system seems to understand who should have edit rights.

Does anyone know what might be going on?

Answer 1

I would try it slightly differently, I'd give both groups contribute access to the list and contribute to their respective folders. Using the Read All items and Edit only their items will work sufficiently.

Typically though, this is a good situation where separate list/libraries are to be used. I try not to intermix permissions to ensure there aren't any breeches.