Essentially, you want a roles-based solution. You could hand-roll one - they're not that hard. Or, you could just use an off-the-shelf solution like LDAP. *shrugs*