SecuritySuite - Enhanced SuiteCRM Teams

Absolutely. The first part is exactly why SecuritySuite was created. To do that you would create a Sales Document group. Then assign a role to that group that sets everyone's rights to Documents to "Owner". Add all sales reps and the admin to that group. They will only be able to see documents that they are assigned to. Now for the sales admin create a "Document Admin" role and assign Group rights to Documents. Assign that role to the sales admin. When the sales admin logs in again (SuiteCRM caches permissions in the session so users will need to log back in before any changes you make go into effect) they will see all documents from their team.

The key part to this is the auto inheritance. You will want "Inherit from Creator" checked in Admin->SecuritySuite Settings so that when a sales rep creates a Document it will also associate the Sales Document group to the document. Without that group assigned to the document the sales admin will not see the doc.

The Marketing Document group would work similarly, but the role you assign directly to the group would have Group rights to Documents so that they can see all docs in that group. I suggest assigning the role directly to the group in both cases as it is easier to manage. Then you assign roles directly to users for the exceptions.

Hope this helps!

Closing this out for now, but feel free to follow up if you need anything else.