table users
username: string
password_hash: hex
acl: bit array

// permission to read employee data
public const long READ_EMPL_DATA = 0x01

...
{
    User user = database.GetSomeUser();
    // test for READ_EMPL_DATA permission
    if (0 != (user.ACL & READ_EMPL_DATA)) {
        // access granted
    } else {
        // access denied
    }
    // give READ_EMPL_DATA permission
    if (0 != (user.ACL & READ_EMPL_DATA))
        user.ACL = user.ACL & READ_EMPL_DATA
}

table group
groupname: string
acl: bit array

table user_group
user_id: id
group_id: id