For example, you could add

permission dept_leader = dept->leader

in your user definition and then

permission leading_dept_leaders = leading_cs_user->dept_leader

in team and then finally you could do

permission access = team->leading_dept_leaders + ...

in your business type. This is quite verbose, but it works.