Processing access validation

You can put column level permissions on a table. So if userB doesn't have it, it doesn't see it. ie you could show a staff table but hide salary except for payroll and HR.

Careful with that one in your application code, use select * from ... if you name the column in the code and permission is not granted you'll get an exception.

Row level security usually done via a stored procedure or a view, you could do it with raw sql but that will get painful after a while.

Don't allow access to the tables then write views one for each type of user. If you match the type to the schema.

MyData.Payroll.v_Staff ...
MyData.Manager.v_Staff ...

the generic way is toadd a usermask column to each table, pass the user id into the view or sp and then only return data where userid and mask match up.

Prefer the role based mathods myself.