Database design for application with multiple useres
Just to give you some ideas here are some of the ways I have seen this implemented:


all interactions with the database use stored procedures and views to limit access
groups are implemented in Active Directory. Members are added to groups. When a user logs on and is authenticated to the domain by AD the application calls a stored procedure which returns all the groups the user is a member of. The membership is cached in memory for the duration of the session. Behind the stored procedure are tables for groups, users, user => group, group=> permission  (create a unit of work, process, close...)
in the application every time a page or view loads you check what the user is authorized to do.  It leads to some less than elegant code like   IF CAN_READ then ....ELSIF CAN CREATE then....  There are undoubtedly more sophisticated ways to set the permissions.
the database has an active directory group for the administrators and a generic app user with permissions on all the stored procedures. This method means the application enforces the permission structure set in Active Directory not the database.  Others prefer the database to have roles which set user permissions but then you lose your Active Directory Management.