Permissions are matter-based, not department-based.
Ordinary access control asks which team you're on. A firm has to ask which matters you're on, which changes constantly, and which people must be walled off from — an ethical screen is only real if the system actually enforces it. Most off-the-shelf configurations can't express this without being set up deliberately for it.