Table Users (
    id     BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
    info   CHAR(255) NOT NULL
)

Table Organization (
    id     BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
    info   CHAR(255) NOT NULL
)

Table Otdel (
    id     BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
    info   CHAR(255) NOT NULL
)

Table Project (
    id     BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
    info   CHAR(255) NOT NULL
)

//"системные права" 
Table sysRights (
    id        BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
    rightName CHAR(32)
)

Table userSysRights (
    id      BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
    userID  SERIAL,
    sysRightID SERIAL,
    UNIQUE KEY userRight(userID, sysRightID),
    FK(userID)  -> Users(id),
    FK(sysRightID) -> sysRights(id)
)
//"права на уровне компании"
Table orgRights (
    id        BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
    rightName CHAR(32)
)
TABLE userOrgRights (
    id         BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
    userID     SERIAL,
    orgID      SERIAL,
    orgRightID SERIAL,
    UNIQUE KEY userOrgRight (userID, orgID, orgRightID),
    FK(userID) -> Users(id),
    FK(orgID)  -> Organizations(id),
    FK(orgRightID) -> orgRights(id)
)
.... И т.д. для Otdel, Project 

Array(
  //Системные доступы
  [0] => Array(1, 3, ...),
  //Доступы уровня компании
  [1] => Array (
            //В компании 1
               [1] => Array(2,6....),
            //В компании 5   
               [5] => Array(4),
              ....
            ),
........ аналогично в [2] для Отделов, в [3] для Проектов
)

$conn = mysqli_connect($dbHost, $dbUser, $dbPass, $dbName);

$loginHash = mysqli_real_escape_string($conn, $_GET['userLogin']);
$passHash = mysqli_real_escape_string($conn, $_GET['userPass']);
$salt = mysqli_real_escape_string($conn, $_SESSION['salt']);

$result= $conn->sql('SELECT aa.id 
                     FROM   Users AS aa 
                     WHERE  MD5(aa.userLogin)="'.$loginHash.'" 
                        AND MD5(CONCAT("'.$salt.'", aa.passHash))="'.$passHash.'"');