There is a pattern to security the objects of my web system?

maybe my subject/title is confuse but I really don't know how to start this thread.

We are looking for a pattern to set the security of our web system. All the options, forms, and reports should have permissions that allow or disallow the user to operate it. The users can have or not the permission for a specified function. There is a better approach to it?

I was thinking about something simple, like the windows folder security and user/user groups. The user can read/write allow/disallow each function, but I want to be sure about this is the best option, if there is a better option.

Thanks