In its most simplest form, create a modules table (moduleid, modulename), a users table (userid, username) and a user_modules table (moduleid, userid). When someone logs in check that there is a record in the user_modules table corresponding to the module and the user. If one exists then they have access otherwise they do not.