Separate communications from department work
A broad employee communications hub might hold approved news, policies and common forms, while department-owned workspaces hold working documents and team processes. Owners and members are assigned through tenant-approved groups, with restricted material kept in a separately governed site where the access matrix requires it.
Owners then test representative personas: an employee can find communications, a department member can update the agreed workspace, and an out-of-scope user cannot open restricted content. The tenant’s requirements and the customer-approved access matrix determine the final boundaries.