What database structure should I use for a process (business Rules) that is dynamic?

Question

When we are developing software we always come across this question: "Is software forged by processes or are processes forged by Sofwtare? Or both?"

Case Study -

I work at a company where business rules are not so well established, or they’re very flexible and change all the time. At least three times a year. We have about 14 usertypes in our business rules, but because of the flexibility usertype3, for example, which had some privileges to access system pages and specific parts of those pages, can suddenly assume the privileges of usertype8 and have access to pages that it could not access previously. The worst-case scenario is when you change this user’s permission to a particular page but this page needed information from previous pages that they didn’t access or don’t access.

The software was developed about 5 years ago and during this time, all the patches were made in a chaotic way in the system, so that today the different users with their specificities are registered among the about 800 pages of php code. It has reached the point of unsustainability where maintenance is becoming unfeasible, and gambiarras are everywhere, and tbm in the (us) database.

So this year’s priority is the restructuring of the system and yesterday’s discussion was about the database. What should be the ideal model to support this flexibility of business rules?

The basic request from the project manager is that has to be a model that has infinite usertypes and requires as little maintenance as possible.

Model - 1

Well, with this rule where there are no established rules I got a little lost and put in doubt the operability of such a system. But even so, I did some research and put together a model that might solve the problem of access to endless pages by infinite types of users. This model is self-explanatory. The word adm which you place in each table is only for marking system administration tables. The object tablets refer to objects within the page. Objects that present content and behavior based on criteria previously or in the future defined. The table tblcontacts is where are system users, login data, password etc.

Model - 2

The fact is that my model was not accepted by the group. The model that was accepted is a table (only a table - tblAccessLevel) where columns are possible system pages and rows all system users. There will be no more usertypes but access levels. The levels can be from 0 to infinity. So far we have about 20000 users and 800 pages. That is to say, TODAY would be a table of 20,000 X 800 (so far). For example, each user will have level-0, for page-1 or level-7 for page-50, etc..., where level 0 is unauthorized user.

I found this solution a little strange but I do not rule out the possibility of being the correct one and so I wanted to hear from the group what you think and according to each one’s experience, how would be the system maintenance based on the second idea. And tbm wanted to see criticism of my Model solution - 1. Tbm wondered if there are any models that are already used in the market with the same idea.