Logic for Access Levels

Hi Experts,

Can anyone give my any ideas on how I can about creating Login Access Levels that admins can use to specify which access level can access which module for a PHP/MySQL application.

There is a pre-defined list of ~25 modules going up to 2 levels deep, for example:

                           
As you can see there are modules, and sub-modules, but there won’t be sub-sub-…-modules… just the 2 levels. I tried to make the 2 reports indented to demonstrate sub-levels, but EE won't let me.

To further complicate it, each may have either yes/no as options, or Full Access / Read-Only / No Access as options.

I guess, I’m looking for ideas on how to structure my DB for this, so when admins create a new level, I can use  it as a template, then save the selections for each level.

As for the actual restriction, that I have  figured out partly…  I imagine that each module would be a database record, so I would pull all records associated to the user’s level, store it into a Session Associative array, then for each module do an If statement.

Any ideas would be greatly appreciated!