Designing An ACL Based Permission System
I did something like this a long time ago.  Yes it is possible.  No it isn't too hard on the technical side.  I don't think you will have problems in the areas you are asking about.  Really this is pretty basic stuff once you figure out how acls are supposed to behave.

The issue you will run into has to do with consistently enforcing the acls.  It is very easy to forget it once in a call somewhere and you suddenly have the acls not doing what they are supposed to. Oops, security issue.

If you are on PostgreSQL, you could probably use SQL roles and views to enforce this properly on select statements, and so forth.  On MySQL I think this is likely to be more difficult.  You will probably want to have some consistent way of adding clauses to your queries so that you are able to ensure they are enforced all the time.  Do this programmatically. Do not try to do it manually unless you want security holes.