You should use a specific ACL module for Drupal, such as Content Access.
The ACL module does nothing on its own:
The ACL module, short for Access Control Lists, is an API for other modules to create lists of users and give them access to nodes. It has no UI of its own and will not do anything by itself; install this module only if some other module tells you to.
Here are basic instructions for setting up the permissions, content types and content access:
- Install Content Access module. Note: you will be asked to rebuild the content access permissions. If you have a lot of content on your site, this action may take a while.
- Create necessary user roles at
Admin -> People -> Permissions -> Roles
- Create necessary content types.
- Go to: Admin -> Structure -> Content types -> Edit [Your content type] -> Access Control tab
- You can there setup specific permissions for viewing, editing or deleting nodes according to the group a user belongs to.
To elaborate more the security risks in handling permissions manually: your senior is right - it is always better to have a centralized system which will manage access control on a website. This way maintenance is easier and you do not need to predict all possible outcomes in order to prevent access to sensitive data at all places.
At some points in custom implementation you might reinvent the wheel, which is completely unnecessary, especially if you can already use an existing framework for setting up those rules.
Imagine the following situations: you blocked direct access to particular nodes using a custom module. What happens if a user goes to /node page and your node is listed there? RSS feed page? What happens on category pages? What happens if you use a contributed module which shows nodes and might possibly expose your sensitive data? What if the modules are updated with a security bugfix and you need to update all your code?
If you are writing those rules manually, you would need to write a solution for all possibilities and still you/someone else be able to maintain that.
Not all problems will be solved by using centralized system, but the risk is significantly reduced; all third party modules are made according to that system. You can call it a convention.
By saying that you want them to be able to edit a column I guess that you are speaking about nodes. If this is not what you mean, elaborate your question a bit more.