02-26-2016, 06:48 PM
I actually do almost exactly that from time to time. I do use the permissions table, but I just check to see if a user is moderator or admin level, then dynamically generate the content based on their level, thereby controlling what they see and can do. That being said, some of those pages still have forms on them, so I still need to use a combination of the permissions system and the CSRF type protection.