We're converting from Indirect to Other Work for the same set of topics that you reference. We are creating separate instances of each - 8 groups, 8 instances each of absence, vacation, training, etc. Then,
- put each groups' instances under a parent instance which is turned off to time entry
- assign one manager from each group to manage the group's instances
- create a security group that has booking rights for the groups resources and other work instances
- carryover the Charge Codes we had used in Indirect, assigning them to our new Other Work instances
This way, each group owns their own set of "indirect" Other Work instances - they own it and they can manage their own resource allocations according to local needs.
We are also changing the Team\Default Allocation value to 0%. Now, this value is applied to all investment types and we have some groups upset that the default will be 0% on projects, too. For them, we are training them on how to use the "Set Allocation" action on the Team\Staff page, and we are also considering the development of a custom "Set All Allocations" action, one which will set the default allocation of all team\staff as the out of the box action is limited to selecting one page of Team\Staff at a time.
We stay away from granting rights directly to OBS branches. Granting rights via OBS branches is easy, but its very difficult later to trouble shoot/maintain. Also, we want to separate the acts of resource editing vs. security access - we don't want a resource editor to be able to change the security access rights of a user by changing the user's assigned OBS branch. But, that's us. Can also envision a scenario where one might move the OBS fields on resource to a secured subpage and develop a portlet that would display the rights assigned to OBS branches - a scenario where the trouble shooting/maintenance/security issues are addressed. If one doesn't address such concerns, stick with using security groups.
Expect to go live before end of 2017Q1.