Ask Agaric: Multiple section setup

A visitor wrote:

Hi - I saw on your site an extended discussion re: the virtues of one multi domain solution over another, and since this is something I am wrangling with, I thought I'd contact you for your expertise. I am building a site so that 23 schools can each record the development of their creative projects, and then occasionally open up their area to invite in other schools to see how tthey are doing. I thought that organic groups (hub) might be best for this, until half way through the process I ran into all sorts of issues with user permissions and found I'd accidentally managed
to lock myself out of sections of the site... Now I'm wondering about contolling it through content access rules and taxonomy... I think I
prefer one domain split in to discreet sections over a true multi domain.

Since the users will be seven to ten year olds for the most part, it has to be both simple and naughty-proof. Do you have any hints on the best solution? Ta for your time - if you have some and the inclination.

Agaric wrote back:

Organic Groups does sound like what you want. If you log in as user number one you always have access to everything, no matter what permissions you set, so you can fix anything set wrong.

We don't have experience with OG though. As you note, true multisite (separate conent, shared users) which we do have a lot of experience with is not what you want.

The other approach is Taxonomy Access Control. It's a very complex module, but if you check off the right boxes, you can be pretty sure you can do anything you want-- let this role post in this taxonomy (for instance, a forum) but not in this one, and not even see this one, while let another role do the opposite, etc.

(Our free consulting is a little thin, we admit.)