[ivanyv]

That is an extremely broad question, and the answer depends on your application.

I suggest you outline what type of application you're building and related requirements, and post that to http://stackoverflow.com

[shorbaji]

Thanks for the tip. The question is broad because I am looking for guidance how to even get started tackling the problem.

The application will allow buyers to complex RFPs online & sellers to respond to them - a collaboration. I will need access control to allow users within and across companies to collaborate with appropriate restrictions.