I've worked on two LAMP applications now where the security system is entirely in the web pages. The DB user has a wide, but not overly powerful level of access (it can view and modify all data but cannot alter the schema). Having a couple of role-oriented users in the DB as you describe could be interesting, though there's the maintainence aspect.

Wade.