Restricting tickets visibility to Brand

The solution presented in Multibrand: Restricting agents to specific brands (Enterprise), as commented by Mjaman, 'falls short of what we really need,' and mostly because brands are attributed to tickets, instead of agents.

The challenge here is visibility: if I don't want agents who work in Brand A to see Brand B's tickets (regardless of Group and/or Organization), there's no way I can set it up.

Brand visibility settings would need to be present in both Users and Roles: users could belong to one more brands, and their role would allow us to set ticket visibility based on brands.

Examples:

• User belongs to Brand 1. Role would allow user to access all tickets within their brands (in this case, Brand 1).
• User belongs to Brand 1, 2, 3. Role would allow user to access all tickets within their brands (in this case, Brands 1, 2, and 3).
• User belongs to Brand 1, 2, 3. Role would allow user to access all tickets within their organizations (e.g. an organization with customers from those three brands, which included the agent, they'd be able to see only their).

This would probably mean more versatile permissions within a Role... In other words, why a single choice (drop-down) option, instead of multi-select?

For example:

• Role 1. Agents have access to all tickets within their Brand(s).
• Role 2. Agents have access to all tickets within their Brand(s) and their Group(s).
• Role 3. Agents have access to all tickets within their Brand(s) and their Organization(s).
• Role 4. Agents have access to all tickets within their Group(s) and Organization(s).

Thanks in advance for any input/feedback!