The internal user security features of Access went away when the engine changed from JET to ACE and modern Access will no longer support old-format database security even if you have it. Therefore, the only reasonable way to do this is to implement your own security. Which means you must NEVER show your users the inner workings of anything.
You will need a "master" form that you use to launch other forms, reports, etc. You need to take steps to disable the special startup keys that would bypass your security features. You need to tailor the options for your database Front End so that users cannot use certain features. Then each form needs to test what role a person plays, so you need a table internal to your app that lists authorized users and their roles.
Use this forum's SEARCH function for the topic of securing your database. You should find literally a couple of hundred articles on this subject.
I regret to inform you that Windows security won't help very much here. In order to use Access, you must have the MODIFY-level generic security setting for all files in the folder where your Back End file resides. Even if the users don't modify the file contents, they must modify the lock-file content and, in fact, be able to create or delete it. The ONLY way that Windows will help you is, if this is a domain-based security setup, you can use the Environ("UserName") function to find the login ID of each user. So if your user table is based on domain user names, you can have a trustworthy way of looking up the user's role based on that domain-level user name.
Here's the basic mechanism: If your control form NEVER GOES AWAY until your user exits, it can act as a visible shield against prying eyes. You can make the control form maximize itself, block most of its controls, and only show the user buttons to push to see a given form.
Each form, as it is launched, can test the role of the person who is using it, and decide what to allow. Each form has properties such as AllowEdit, AllowDelete, etc. that you can set in the Form_Load event code to block the user from doing basic things that could muck up your data.
It will be up to you to research this more, because I don't feel like re-inventing the wheel here, particularly when everything you need to do IS covered in articles on this forum. And in fact, this is where I learned how to do that MANY years ago.
