We have several use cases where we would want to layer department and groups to limit which admins can view/assign/report on courses. We are unable to strictly use groups because of our complexity and we need locked departments to prevent custom content being shared across departments. Rules similar to self enrollment would be ideal.