We had the same requirement here where more than one department may require access to the document. We have done this by making use of the named access control lists (NACL). We created an NACL which has multiple groups and properties set up within it. So if you add the department property to the NACL with the required permissions. By doing this we only get one Permission set on the object thus no implementation of AND and the NACL object behaves like an OR.