Database object security

I'm trying to figure out how to incorporate security in various form and reports in a database.  When the user logs in to the database via a login form I have a table being populated with that user's name and security level as determined by his record in a table named tblEmployees.  There are 3 different security levels,   1, 2, and 3.

So then form example, all forms and reports are to be read-write for level 1.  But some forms, for example, may be read-only for level 3.  Other may be read-only for level 2.

All of the forms and reports will be opened via command buttons on the Main Menu of the database.  Maybe the best way is to have code in the on-click event of each command button?  Or is it best to have a public function so the code is written once and then call it with the on-click event of each command button?