<p>we're developing a web app to cover all aspects of a printing company from finances, to payroll, to job costing.  Its important to be able to control who can access what parts of these applications.  Don't want a line employee giving himself a raise, etc...</p>

<p>I've heard of the concept of ACL &amp; ACO, but haven't found a good example that we could adapt to our project.</p>

<p>Anyone know where I can find good information to work from?</p>

I've had to implement that type of security a couple of times.  Unfortunately I don't know of any really good articles that provide examples.  My implementations were mainly piecing together the parts through trial and error.
However, I did come across this link on MSDN:
http://msdn.microsoft.com/en-us/library/52kd59t0(VS.71).aspx
It has some of the concepts.
After my original post, I did some more research.  I found this article:
http://www.aspfree.com/c/a/C-Sharp/Implementing-Role-Based-Security-using-CSharp/
it seems pretty promising, I didn't go through all the details, but it at least guides you through the high-level topics.