We're in the designing and planning phase for our intranet portal at my company and we're hitting the problem of how to split up the permissions on a specific site. I was wondering what some of you guys would do.

For example the uk intranet site has various subheadings e.g. pensions, benefits etc but how would we securely prevent people from benefits from editing the pensions section if all the documents go into the same pages web folder? I've thought of using workflows that assign a permission based on the content type etc, or simply using subsites but is there any easy to accomplish and prefereably fairly out of the box way of doing this which I might not be aware of?