Advice on Multisite planning

Hi there,

I've been experimenting with Drupal, planning to migrate a website from Typo3. As a part of the migration, I've been rethinking the structure and setup of the site and would really appreciate your input.

Current setup:
The company I'm maintaining the website for has three distinct operations. Therefore the website has a basic landing page with links to three sections of the website. As the Typo3 approach is quite different to Drupal, I've set up a page tree with the three sections branching off the landing page. Each branch has unique content, but all can be easily administered via single login.

www.example.com <-- Landing page with basic info and links to the three branches
-branch1
-branch2
-branch3

Now, my thinking is that I could set up a single site, using vocabulary to group the content in the different branches, emulating the tree structure in Typo3. However, one of the benefits of moving to Drupal would be to allow visitors to register at the site, gaining access to services currently handled offline. These services are unique to each branch of the site, even provided in different languages, so I thought a multisite approach with subfolders would be more logical.

The new setup would then be:

www.example.com <-- Landing page with basic info and links to the three child sites
-www.example.com/site1
-www.example.com/site2
-www.example.com/site3

As I would need to restrict users to the child site they register on, and with the content being unique to that site, I assume the simplest way would be to create separate databases for each child site. Is that correct?

However, the same couple of persons would administer all the sites, updating content, accepting new registrations etc. Again, the easiest way for me would probably be to setup separate admin accounts in each of the databases, but then they would have to login at each of the sites for administration. Is it possible to share admin privileges across the sites so the admins could for example login at the landing page and then move through the child sites for administration while restricting authenticated users to the child site they registered on?

Am I missing something obvious, overcomplicating things or what?