How to maintain different security levels

Assuming that your MIS is loaded in a Windows environment (as suggested by the C# tag) then I would suggest that you use the tools already on hand: ie your LDAP or machine SAM. Define roles in your software, assign roles to groups, and assign users to groups based on least privilege. This has the benefit of using the same Authentication/Authorization as the system that is executing the request and releases you from having to track users and groups.

Software role management has many implementation possibilities. I like defining capabilities in derived user objects and calling them as delegates or events from my execution path, but you can do something as basic as switches at key decision points if you really want to. It all depends on how decoupled you want or need to be.