I've seen customers set up different ways, but the one I like the best is:
Separate OU for Qlikview.
Group for every Document named: Qv Users - document name (eg Sales).
Group for developers that covers write access to the common development directories: QV Developers.
Group for restricted developer directories: QV Developers - Payroll
Group owner approves membership in group. AD security team does the update. The OU can be delegated to QV Admin if desired.