If you use the ion_auth library it has a builtin table of user_groups.
There you create your groups.
Then you create on more table called group_priviledges.
group_priviledges table has id, group_id, description [even a url, or function name] as a list of all the available priviledges.
Then you assign your users to groups.
And you get (via your model) a true false value if the current operation(make an add/delete/update, redirect to x url, or call y function) is allowed for this user(group).
You make the system once and then you forget it for ever.
And you have a nice grocery crud interface to add/update all these data!