Dynamic AuthorizeAttribute with database
Yes.
You are close, man!

You have to make relashionships between pairs of controller+action to some user actions.

For example:
Security Staff can only view Personal Info:
- View Personal

Then your HHRR Manager can:
- View Personal
- Add Personal
- Edit Personal

And finally HHRR Director he can do more actions like:


View Personal
Add Personal
Edit Personal
Delete Personl 


And now in game you should include some extra tables, bro! hehehehehehe

Lets say your system has HHRR module. 
Add this module record to the AccessModule table. Then add 3 records to AccessModuleActions like


HHRR Director
HHRR Manager
Security Staff


Apply ACL to each user via PersonalModuleActions table. Acctually you should use PersonalModuleActions at website admin GUI area.

And internally (no GUI for it) you will gonna use WebSiteAccessModuleActions table
where you keep relashionships between controller methods and those "roles".

This approach allows use


  1) Ignore methods that are not described in WebSiteAccessModuleActions
  
  2) Build very flexible ACL subsystem.


As you see we manipulate  kinda of groups of controller methods represented in
a user friendly manner

- HHRR Director
- HHRR Manager
- Security Staff


So when I said you are close it is just implement one more level of abstraction. 

Enjoy, dude!



P.S. Include Area columnto the  WebSiteAccessModuleActions if you have
identical controller in several website's areas.