Permissions by taxonomy for taxonomy and nodes I have following setup:


Taxonomy Departments (hierarchical in at least 3 levels)


Location A


Team A.1


Subteam A.1.I
Subteam A.1.II
Subteam A.1.III

Team A.2

Location B


Team B.1
Team B.2


Taxonomy "Worker" (taxo ref to "Department")
Content Type "performance review" (taxo ref to "Worker" and to "Department"), one user may have multiple of reviews (they can be done from time to time, like every 3 months)
Users with a specific role ("Manager")


What I need is:


Managers should only see specific departments and all workers in that department
If the manager can see Team A.1 (or Location A) he can see all (Teams and) Subteams also (and all workers belonging to those)
Managers should only see the performance reviews of workers he has access to


The question is:


How do I best go forward to get there?


Problems I found with existing modules and more problems:


You can give node acess based on taxonomy, but those modules don't give access to taxonomy based on taxonomy
To me it would be logic to give the user accounts a new field with reference to the "Department" and build the permissions from there. "Acces by Reference" for example would need me to give the "Department" a reference to users (which you could argue for, but in this project I would prefer the other way (or a synced both-way-solution).
Just in case you wonder about this: The review references the department (instead of always getting it from the referenced Worker taxo), because when workers switch to another department, the review should stay in the department in which it was created


If the only way forward is programming my own module:


Is this a good starting point: https://api.drupal.org/api/drupal/modules%21node%21node.api.php/function/hook_node_access_records/7.x ?
I Think You need to take a look at Permissions By Term and you may need to get an extra step to implement some code to provide the required term and assign it for the required permission according to your required hierarchy.