How do user permissions work for multi-level organizations?
Yes - I've done this several times.  Many organizations with a chapter/branch format do this, such as IMBA, Wikimedia Foundation, the Australian Green Party, and many others.

There are several different approaches you can take.  


The "easy" approach is just to use built-in ACLs.  Create groups of "staff" and "members" for each chapter, using parent/child groups to handle the hierarchy.  I've done this for a union with 10 locals.  I wouldn't scale this much past that.
The "heavyweight" solution is CiviCRM Multisite  You'll want the Multisite Permissions extension.  Use this approach when each chapter needs its own website.
The middle ground is to use Relationship Permission ACLs.  I haven't used this, but it's helpful if you a) don't need separate sites per chapter, b) you need 3+ levels of organization (sounds like you do), c) You have enough chapters that using traditional ACLs is unwieldy.


As of November 2017, the relevant docs are being reorganized.  Multisite is being separated from multi-level ACLs.  However the original wiki page combining both is still online.