Security Group Management

Interesting take, I would need to spend some time to fully understand/follow your suggestion.

In the application there is already a table with each of the (17) companies, there is a table with the departments (there are 139 to account for the various departments within each company), and there is a table for office locations (of which we have 51). These are all lookup fields to the Employee table. This was done to ensure data entry consistency.

Does knowing there are these additional tables adjust your recommendation?

I feel confident on being able to determine the "easy" groups, those groups that just need to reference a single field selection (i.e. Company group, Main Department group, Office Location group, etc.). The ones that are more difficult are when the rule needs to evaluate based on multiple fields.

Example: we have 17 Companies, and of those 6 have an Accounting Department. So for our Accounting security groups we actually have 7, one for anyone in accounting, then six additional groups for each company-department combo. An employee would then be a member of the company group, the all accounting group, their specific company-department combo group, and their office location group.