I'm working with custom software here, so don't worry about Microsoft whatever, Open anything, or something else. Let’s stick to theory of how this should go together.
Let’s say I have a user system/database.
The database has a table of users, and their associated user-groups (Admin, IT support, Manager, Secretary, client, guest). These aren't hierarchal, but rather memberships to groups. For instance, Alice can be an Admin and Client if need be.
Permissions to an application are assigned to the group, and in the case of multiple-group assignment to a user, the permissions form a simple binary OR of rights (i.e., Admin has X, Guest has Y, then the user gets X and Y).
Applications are a way to do things in an application, they bar access or allow for it. For instance, you have access to "StackExchange" but only to Read -- or you get access to post, or moderator tools, etc...
So to recap, users get groups which govern what rights they can access.
The concept I'm having trouble with is locking down specific records to the user group, especially if we're working across multiple applications. So, for instance, only Admin group can view some posts in the "StackExchange" application.
I don't want to have to add rights to every record, and I don't want to make redundant application code with a minor change.
How would you approach this?