What would be the best way to organize permissions in this situation?

[Wessel Straatman]

So we recently started implementing the use of Atlassian Confluence in our workflow and so far are really liking it. However, we are still deciding on a good arrangement of Spaces and pages, and the corresponding permissions. Since we regularly get grad students to do work for us as part of their study, we would like to be able to give them access to specific pages that they would need, but do not want to give them full access to that Space for obvious security reasons. Moving the pages to a space that requires less strict permissions is an option, but it would remove the current structure that we have that bundles the similar pages to the one that we do want to give access to. So that would take away the benefit of proper usage of a Space. 

So as far as I can see, there's different possibilities. One is to give the students access to the space, but then limit their view to only the pages they would need. The advantage of this would be that you would contain the structure of the spaces and maintain security. However, the downside is that anyone who creates a new page in this space will have to remember to limit the viewing to the page, since I have yet to find a option to set default page permissions that are not the same as the default space permissions (I don't believe that option actually exists). 

A second possibility is to create a Space specifically for the students, and copy pages there that they could need. The upside is that this makes it really easy to maintain security. The downside is that there's now two versions of the same page in different spaces, which do not automatically sync up. I also don't believe there's a way of making sure the pages are 'linked' so they sync up automatically, right? So that would either require the students pages regularly get updated, or that they work on outdated versions (which would not be that big a deal I guess for some pages, but might be for others).

A third way is to do something clever. So far I've tried things like embedding a page from a hidden space on a page that is accessible to the student, but unfortunately (although I shouldnt say unfortunately since I do believe its good that Confluence security works this way, just not for my purpose right now ) the embedded page is visible for me but not for the student (as it should be, I know). 

So what do you guys suggest is the best way to go ahead with this? Thanks  

[Alejandro Conde Carrillo]

You could create a separate space for the students and copy the pages there. You could keep a page with the same title in the more restricted space containing only a include-page macro to display the content of the actual page. This way you keep only one version of the page and keep the structure in the space tree of the most restricted space. To edit the page content, you will need to do it in the space open to students.

[Davin Studer]

I would suggest this solution too. Also, instead of assigning students directly to spaces I would recommend assigning groups to the space and then making people members of the groups. Assigning permissions to individual makes it harder to manage down the road. So, create some groups that are good definitions of the distinct roles (student, admin, faulty, etc) and then assign people to the groups.

[Wessel Straatman]

That was already the way I was going (with a Student group instead of individual rights. I might not have made that clear enough, sorry for that.