I'm wondering if one could use a Case Statement when locking/unlocking fields depending on Group membership.  I'm thinking if there is a way to list the groupID's in such a way that the broadest permission appear first, then admins (for eg) would not see Sales related formatting (for eg).
Perhaps an additional unique integer field  could ID each group with the lower number being the highest permission. Then a dmin could find the number.
Side note: use the convention of incrementing Groups by 5 so there is space for inserting more qroups within the existing hiarchy in the future.
Does the idea have merit?

---

Reply from Richard Rost:

Hmmmm.... are you thinking something along the lines of nested permissions? Like ADMINS have access to everything that SALES people have plus some? That could work. This would be a little tougher to implement, but sure... it could be done. I would nest the permissions inside of a function that determines permissions, like:

Function IsSalesRep(UserID)
  If IsAdmin(UserID) then
     IsSalesRep = TRUE
  End If
  ...
End Function

Is this what you're thinking of?