>I am trying to come up with a security design scheme for my application. I have a Users table, a Groups tablea and a Rights table.
>
>The problem is that it's not just access to specific areas that I need to code for. I also need to allow only certain groups of users access to specific documents.
>
>For example, if a sales rep makes contact with a client, the other sales reps cannot be allowed to see that information.
>
>Only certain groups of people in the organization can be allowed to see certain data, so I need a way to set this all up in the data.
>
>Thanks


I think you are on the right track with groups. A simple approach is to assign a security level to each user group, and a security level to each function or data you want to protect. Then in form or program startup call a method that compares the two levels and issues a message if the user's access is insufficient. If you put that somewhere in the application framework that gets executed automatically whenever a form or program is instantiated, it's no muss, no fuss. Just watch out that it doesn't add too much overhead by running through the whole security apparatus every time the user does anything.