If you decide to create your own node access module, you may save a lot of work by making use of the [ACL](http://drupal.org/project/acl) (Access Control List) module API.  Basically, it is a well-maintained and simple to use framework to create and maintain ACLs for nodes.

The business logic you seem to have in my mind is complex (too complex for my taste), so it may be hard to solve this with only front end tools.  An alternative is to rethink the business logic, and adapt it to what can be done with front end tools, such as the Node Access module (as suggested by David Thomas).   However, the Node Access module has been abandoned and is listed as unsupported.  This is also something you need to take into consideration when deciding on the route to follow.