How would you use Access Control Lists (ACL) to support multi-faceted, ad hoc group access?

I’ve constructed the following flow charts to attempt to illustrate our problem.

First are some assumptions about ACL.

Oracle has previously stated Access Control Lists meet our needs, but with a document needing to be owned by one and only one ACCOUNT, I find ourselves stuck with a pretty custom solution that would add individuals into ACL *based* on group unions. I am concerned about performance too, and maintenance.

This approach does not seem sustainable. I am looking for help as to alternatives (attribute filtering maybe).

To me this is a content problem and a portal problem, as both could potentially use ACL, but Content is the only one with the requirement of one ACCOUNT per document.