User rules and module rules and access rules

I have a project system. The system requests are as follow: 1. It includes different departments can use different modules to play different roles in this system,and every department have its own rule. 2. different department have many modules. And every modules has many functions, and different functions have different entity access, about read or write or read and write

For example: - Mis Liu is a manager. She can read and write informations - Mis He is a staff. She can't read and write informations - Mis Wang is a staff,she can just read.

So, how can i realize this Mendix Project Security have User roles, Module have module roles and entity access, how can i union them. Or I need create a rule entity to control roles.