A complex ACL case: Securing content in an intranet

In an intranet, every employee can create new content. For each content he creates, he can set whether his content should be
- visible only to him, or
- visible to everyone, or
- visible to those departments/companies he selects from a list of all the units he is member of.

Now the problem is that the organizational structure (departments, companies, teams, etc. and the employees assigned to them) has to by dynamic, i.e. I cannot create pre-defined roles (e.g. Company_ABC_ALL, Company_ABC_Finance, Company_ABC_Finance_Controlling, Company_XYZ_Sales, etc.) because creation of new departments and companies has to be dynamically possible by certain managers (e.g. when a new department is created, a new role would have to be created as well; when an employee is assigned to a new department, his role membership has to be edited as well, etc.).

I thought of either creating a "Company" and "Department" CCK type and relating them using node relationships and user relationships OR using a taxonomy which defines the organizational structure in a hierarchical tree.

Maybe you can support whether I should use custom content types or a taxonomy to define the organizational structure and then if and how far the Rules modules is suited to achieve my goal in combination with one of the two approaches.