We have a large multiuser app that is used by several divisions in a company. One of the design criteria was to apply cash receipts across division lines and, similarly, to share customer and vendor information across divisions.

So we have a single database with the usual permissions that allow users access to data according to function.

But the client now wants to restrict access to data within functions dependent on division lines. I.e., he does not want Mary from division A to see the AP data from Jane in division B. Duplicate invoice checking is still to be done but would result in a message "Jane has already paid that" etc.

So I am looking for suggestions as to how to partition the data to satisfy this client

Thanks..