Security service design considerations

We have already completed the information of the users in security. Now we need to think about how to design the permissions in security services, you need to analyze the permissions that need to be addressed and the original ideas for solving the problem. Record the issues related to permission control. Some resources have been referenced and understood before. There are two types of permission control:
First, business processing control: It mainly controls the services that the current user can process and what functions the system can perform.
Second, business scope control: It mainly controls the ability of the current user to process the business within that range when executing the business. The range here refers to the business data range (the row range of the data table) and the business data attribute range (the column range of the data table ).
Here is a simple example of the order sales process for processing the order sales software:
Create a sales order (Business Department)-> verify the product price (product department)-> Develop a collection plan (Finance Department)-> arrange the production plan (Production Department)-> Develop a Delivery Plan (Shipping Department) -> approval Order (general manager)-> execution-> ....
In this simple process-based business, business processing capabilities can be used to establish sales orders, verify product prices, and other business node capabilities. Here, permission control is used to control business processing, if an order with a sales amount greater than Yuan must be verified by the product department director, the order is under business control. If you need to query product information in real time, and the product resources may include cost information, this information cannot be understood by the sales staff, it also includes some other information about this product. This information may have different permission requirements for different people. How can this complex permission control be met.
I want to design such a set of permission control that meets the requirements. First, we need to separate the content requirements to be controlled from a specific business process and analyze them from the perspective.