authentication for lack of a better subject

hi Suppose buyers and sellers have sensitive information on their respective pages throughout a site. How does one keep a buyer or seller from typing a "guessed" url and seeing perhaps others pertainent data. Not that data itself would be returned , queries wouldn't work etc. Rather how do you lock them out of the page period. Session failure or something. I'm running apache, php4 and have sessions enabled through the site, mysql, etc. Can you do some type of authentication combining these programs? How do you guys skin this cat? cheers.