Permissions / Roles / Taxonomy / Workbench -- combination? Hello dear Drupal enthusiasts,

I'd like to hear your opinion - how to organize mentioned modules/functionality to achieve nice permission granularity.


After user is logged in we have a list of his e-groups (outside structure, we have its names).
I want to build drupal inner hierarchy where I organize user e-groups to tree structure. 
I would like to divide nodes to groups, to allow people who are members of some e-groups to edit some nodes (gathered in group).


What comes to my mind it's to organize page structure in one vocabulary, and allow admin to add a e-group name to some taxonomy.

Example:


Main Site admin [taxonomy: egroup-main]


Department A admin [taxonomy: egroup-department-a]
Group 1 [taxonomy: egroup-group-one]
Group 2 [taxonomy: egroup-group-two]


Subgroup 1 [taxonomy: egroup-students]

Group 3 [taxonomy: egroup-group-three]



And now, after somebody logs in first time, and we know he is part of egroup-main, we give this user taxonomy egroup-main, which is the same we set to Main Site Admin term in vocabulary shown in example.


Is there any better way to organize this? I need fine, good grained control over users by egroups, to access, create and delete nodes.
What about workflow management? I mean - module like Workbench is nice to control workflow, let beginner users to edit, and let admins to publish stuff after review.


I know there's a module called Taxonomy Access but it seems it bases on Drupal Roles which means apart from taxonomy we would have to create dynamically user roles (depending on e-groups), attach permissions to them and assing users to these roles...

Waiting for your hints people!

Confused Drupal developer
http://tutr.tv/t4991?list=4948 is a video from Drupal Con London where they talk about the Workbench Modules and will answer most of your questions/concerns.

If you have Workbench Moderation you can have users submit content for review.  Then a content moderator will publish the content or return it as a draft for changes.

Workbench Access will limit users to what content a user can create/edit.  You just need to create a role, assign the role to a Workbench Access Section of the site, and then when they create a new account you can assign them to the correct role.  

I have this on my site and have created a rule to email me whenever someone logs in for the first time so I can assign them a role.