Permissions feel complicated only when they are built person by person, folder by folder, over years. This starter map takes twenty minutes on day one and stays clean for years.
You do not need the full advanced-sharing theory to start correctly. You need one decision: permissions are given to groups that mirror your departments, never to individual people. People join groups when they join the office and leave groups when they leave — the folder permissions themselves are set once and then forgotten. This is the map, whether your server is Windows or TrueNAS; only the buttons differ.
One root folder, one child per department, plus exactly two specials: Common, which everyone can read (templates, forms, the holiday list), and Management, visible only to its group. Resist every request for clever sub-structures on day one — a folder tree the whole office can memorise beats a perfect one nobody understands. New folders are created inside department folders by the teams themselves; the admin's job is only the top level.
For each department, create two groups: Dept-Full (Modify rights — open, edit, save, delete within their folder) and Dept-Read (look, open, copy out — never change). Most staff sit in exactly one Full group (their own) and a few Read groups (the departments they cooperate with). The director typically joins every Read group plus Management-Full. Notice what this buys: the question "who can touch Accounts?" is answered by opening one group, not by auditing a hundred permission entries.
On Windows, grant the groups on the share and on the NTFS Security tab with matching rights, and remove Everyone, Authenticated Users shortcuts and any guest access. On TrueNAS, the same groups go on the dataset's ACL and the SMB share. Identical groups, identical meaning, whichever platform — that sameness is the point of the map. Do this once, test as a normal user (including trying to open a forbidden folder), and then stop touching it. Permissions are infrastructure, not a daily hobby.
Joiner: create the account, add to their department Full group and the Read groups they need, done. Mover: someone shifts from Sales to Accounts — remove one group, add another; their access changes everywhere instantly, including folders they mapped months ago. Leaver: disable the account the same day. Not delete — disable first, so files they owned keep working and you can re-enable during any handover dispute; delete after a month. Because access lived in groups, there is never a mystery folder the leaver can still reach through some forgotten direct permission.
Everyone — Full Control, chosen "temporarily" in year one and discovered in year three after a ransomware scare, when every user (and every process running as any user) could delete everything. Direct permissions to people, which rot silently as staff change roles. And nested sharing chaos — subfolders shared separately with their own rules, until nobody can say who sees what. The map forbids all three by construction: shares exist only at department level, rights live only in groups, and Everyone appears nowhere.
Watch the video to see folders and shares being created for a real office layout — then copy this group map onto whichever method you chose.
▶️ Watch Full VideoThe map takes the same twenty minutes for four people as for forty, and four-person offices grow. The Common and Management folders plus one group per person-as-department still works — each person is simply their own department's Full group. What you skip at small size is the Read groups, until the first time someone needs look-but-do-not-touch access.
Usually yes for a small business owner, and the map handles it honestly: put the owner in every Read group and in Management-Full, rather than leaving an invisible Everyone entry. Visible, listed access can be reviewed; invisible access cannot.
Give them real accounts (never a shared login), place them in Read groups by default, add Full only where the work demands it, and set the account to expire on their last day. The expiry date does the remembering for you.