How to give dynamic record access level using roles?

Question

I have the a role hierarchy like this:

  manager                        suboridinate
  profiles                         profiles

                    ----------- ChildRole1.1
                    |
ParentRole1---------|
                    |
                    ----------- ChildRole1.2

                    ----------- ChildRole2.1
                    |
ParentRole2---------|---------- ChildRole2.2
                    |
                    ----------- ChildRole2.3

Suppose an Individual record IndiRec1 was created by user with role ChildRole1.1. Now this IndiRec1 needs to visible only to users with role ChildRole1.1 (also editable for all users with the record's owner role), ChildRole1.2 and ParentRole1, because these 3 form a unit. This visibility part I have achieved it using sharing settings and lightning component.

I have a situation where when a user with Admin profile checks Forget This Individual on this IndiRec1, this record should be hidden for all profiles except for Admin. When Admin unchecks the Forget This Individual it should be visible to it's original unit.

I can think of only Apex share, which still isn't good enough:

1. Make Individual object Private in sharing settings.
2. Every time an individual is created, I need to create a new individual share object, indiShareRec, add the recordId to the indiShareRec's ParentId.
3. Specify access level. For ChildRole1.2 it is Read and for all users with Role ChildRole1.1 Edit.
4. Add user or group id's. I have a public group called ParentRole1 containing ChileRole1.1 and ChileRole1.2.
5. Insert this indiShareRec.

Step 3 and 4 are a problem. Because I need to give Read access to ChildRole1.2 where as I need to give Edit access to users with role ChildRole1.1. How can I do this? As far as I know indiShareRec.userOrGroupId takes a single public group id.

Any suggestions? Is it even possible?

Answer 1

Summarizing my comments as an answer:

One way to achieve this, without knowing more about the sharing setup that you've currently implemented, is to pull Forgotten records out of the role hierarchy by assigning them to some user as owner who does not have a role or who sits at the top of the role hierarchy.

You can store the original owner id in a text field or a separate lookup. Then, when you unforget a record, you can restore the original owner so that the original sharing re-takes effect.

Note that at large data volume you may need to think about ownership skew and consider round-robining records across multiple role-less users when forgotten.