I am trying to come up with a security design scheme for my application. I have a Users table, a Groups tablea and a Rights table.

The problem is that it's not just access to specific areas that I need to code for. I also need to allow only certain groups of users access to specific documents.

For example, if a sales rep makes contact with a client, the other sales reps cannot be allowed to see that information.

Only certain groups of people in the organization can be allowed to see certain data, so I need a way to set this all up in the data.

Thanks