Authorization object to differentiate by organizational unit.

Dear Experts,

I am facing one problem and need your expert opinions to solve it.

In my work we are implementing SLCM module, where we have 9 educational faculties or organizational units. The requirement is to create a role that can be differentiated between organizational units.

My question is:

How I can differentiate between organizational units for a role?

What authorization objects can help make the distinction for OU?

What other solution could apply to the requirement?

Thanks for your Kind Support

Regards

Ricardo Herrera.