Adding all the roles with checkboxes is great for flexibility. But seeing it I start to think it would be better to reverse the logic.

"Allow document access to these groups:"

"Only selected groups will have document access."

Can we also list only Staff, Staff Admin, Finance and Contracting as options? Maybe it would be good to add this list of groups to hypha/apply/users/groups.py as "GROUPS_ORG_FACULTY" so we can reference it in other places?

By default we can then have all groups in this list checked.