The way I have implemented it, based on Microsoft's recommendations for Windows Server 2003 (found in the MCSE Self-Paced Training Kit for exam 70-294: Planning, Implementing and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure) is:
- Create a global security group for each position within the organisation (eg, CEO, Sales Director etc)
- Create a domain local security group for each resource (or two groups if you are giving some people read-only premission and others modify permission) (eg, Sales File Modifiers, Marketing Data Readers)
- Assign permissions to your resources, using the domain local security groups (eg, Give Modify permissions on the Sales Files to the Sales Files Modifiers groups)
- Assign users to the relevant global security groups (eg, make your CEO a member of the CEO security group)
- Add the global security groups to the relevant domain local security groups (eg Add the Sales Director group to the Sales Files Modifiers group)
So you have:
User Account -> Job Role security group -> Resource Permission security group -> Resource Permissions
Doing it this way, you can end up with a lot of groups, particularly domain local groups, if you have a lot of resources, but it keeps it relatively simple and maintainable. Trying to get clever and having multiple levels of nested groups is a recipe for complexity and disaster, trust me!
It would also be a good idea to ensure that no-one other than Administrators has Full Control of any files. This prevent s users trying to be too clever and configuring their own permissions.