Workspace

Organisation.

Departments, the units inside them, and one workspace per person. A department can own a skill and share it with another without sharing what it was built from.

What this is for

A department is a part of this workspace, a unit is a team inside it, and each person has a workspace of their own. Create the first department on the left.

Reach goes upwards
Somebody in a unit reaches what their department owns, because they are inside it. It does not work the other way: a department head does not read into a colleague's own workspace.
It does not decide what they may do
That is the workspace role, shown beside each member. Adding somebody to a department never grants a permission they did not already hold.
Sharing is a capability, not data
A skill shared with another department can be run by it. The knowledge, files and history behind it never leave the workspace they are in.
A workspace outlives its occupant
When somebody leaves, their replacement inherits it and everything in it. The record of who sat there is kept, so old work stays attributable.