Give some users (e.g., teachers) access to nodes created by a unique subset of other users (that teacher's students) My site has roles for administrators, students, and teachers. Students create nodes, and each student has exactly one teacher. Teachers should be able to view all content created by their students, but no content created by other students. In other words, I'd like to have some kind of per-user setting that allows me to select one specific other user who can access the first user's nodes.

This seems like a pretty common situation, but I can't figure out how to do it. I'm open to any suggestions. Here are some things I've looked at so far:


I started out by using references to link each student to a teacher. However, I couldn't find a way to use that relationship for access control. 
The subuser module looks appropriate, but I'm leery since the D7 version is still in alpha. Has anyone used it for this purpose?
Taxonomy access control looks like another possibility. The list of teachers is static, so it could be made into a vocabulary. But if Teacher is a per-student setting, is there a reasonable way to make that propagate down to the nodes created by that student?
Any other suggestions about how to do this?
I've had success with multiple node authors using
nodeaccess_userreference

Gives content access permissions to users for content that references
the users with User reference or Entity reference.


and also with
nodeaccess_nodereference

Gives content access permissions to users if they have access to
content that is referenced with Node reference or Entity reference.
Checks view, update, and delete grant operations, and can pass those
on to the referencing content, or trigger a different grant
configuration according to settings.


In combination with field_permissions or hook_field_access, for restricting access to the reference field, that should enable the feature you're looking for there.
You may want to look at using Rules to set the reference field value on node save as well.