I have used this kind of logic with plenty of success:
*User info is stored in a database.
*At the top of each restricted page, a function restrict() is called, with parameters specifying which type(s) of user should be allowed to view the page.
*restrict() checks to see if the user is already logged in. If he isn't, a login form is displayed instead of the page. If the user is logged in, restrict() checks what type the user is logged in as, and then restricts access to the page accordingly.
I have never needed to grant priveleges to specific users - only to general types of user - but I'm sure you can think of something clever for that.
-Keegan
P.S. This probably isn't going to be as complicated as you expect - you might get it done in one afternoon.