Permissions should be definable not one user at a time, but through company, role, user group, discipline, record category and workflow stage. Subcontractors should only be able to see records belonging to their own company and area of responsibility.