PHP / MySQL Permissions Design Help

[MRGRIM]

I am trying to design a fairly flexible PHP company portal. What I am struggling with at the moment is how to create the permissions. The site will be made up ‘modules’  e.g. messages, staff, products etc.

How would you suggest I have a range or permissions e.g. add permissions on messages, but deny read access (as unlikely as that scenario sounds) but then also have a different set of permissions for the other modules?

I was thinking along the lines of roles?

[SomeoneE1se]

I've been thinking about this myself, the two ideas I've come up with are to use a database for individual users/permissions;

id, userID, module, premissionLevel,

or grouping them into groups;

access level: user (read only), editor (create, manage own created entrys), manager (manage any entry), admin (manage users *)

so a "user" could be a editor and create entrys but not a user and read them.