At my workplace, I am one of two "technical" staff for our department, but there is a central IT department as well which is well funded and heavily staffed. They're happy to manage the SharePoint servers, but not the security model or content (that's our job). The central systems are Linux based, and though there are Windows systems with AD groups, they were implemented as an afterthought - all primary group management is done in Linux.
I want to implement hierarchical multiple-axis role-based access in SharePoint, where new/existing staff are added to a "role" (read: group) which itself is a member of other groups. For instance, a role "Professor of Accounting" might be a member of "School of Accounting", and also "Professors", which would then roll up to "All School Staff" and "All Academic Staff" respectively, and ultimately to "All Staff".
We are running on SharePoint 2007, which allows declaring AD groups as members of SharePoint groups, which would be the ideal scenario here. Unfortunately, every single change to AD groups would have to go through central, which would be a bureaucratic and administrative nightmare. Turnarounds on simple change requests are as much as 2-3 weeks, meaning it could take years just to implement the baseline security profile. I would prefer a situation where we declared the roles as SharePoint groups, and manage it entirely ourselves.
I know in SP 2007 a SharePoint group cannot be a member of another SharePoint group. Are there any post-2007 versions of SharePoint that we could upgrade to that would allow this?