We use Zoho desk with 14 departments, some have child departments.
Customers can send tickets via email, or by form specific to department (different fields).

Currently agents are assigned to a department + team on their role.

We'd like agents to have access across all departments if they are in the mail header fields or have a lookup (via search) for department. But if they are not members of department they are blocked.

We've tested assigning an agent to all departments, and members to teams they are assigned to, profile is setup as agent role to "Their Tickets and Unassigned" and change profile privileges to disallow "unassigned", ultimately allowing to only see tickets within their team. Tickets are automatically assigned to a team by workflow.