intranet security

I am currently building an intranet security system to handle internal users and the web applications we have. When we are done we will have the ability to add/remove users, control what apps they can and can't see, etc. One thing I would like to be able to do is set up groups and have the ability to assign multiple groups to a person. Say you have these groups: Admin, Developer, Read-Only and I want to assign Scott to Admin and Developer. Then also be able to control rights on a user level. Can someone point me to some links or let me know how you handled these situations. I have a rough draft here, but would like to see what others are doing to handle these issues. Thanks, -Scott --