Basically we have a RBACish schema in which employees are member of roles, and roles have relations to companies. A role might have permission to view reports from the module "foo", and may also have permission (a different one) to view reports from the "bar" module.