I am trying to keep records separate from certain users when it is categorized in a specific group. For instance, when an account is created if it's in category A I want only group A to have access to the record. Also if it does not have a category, everyone should have access to the account. Right now I have the org-wide default set to private and a sharing rule on account reading off of a picklist. The problem I am running into is the related records. If an account is category A, anyone not in Group A, should not be able to see the related records.
I have considered making a process builder update a field on all the related records and have sharing rules on all the objects. But there has to be a more efficient way. Once the parent account is shared with a group or all users the related records should be shared as well. I have thought about making a custom role hierarchy but I don't think that solves the related custom object records.