Security regarding creating/inactivating/modifying data

Hi
A client is requesting we apply security that will allow them to determine whether a user has the ability to create/inactivate-delete/modify data on a screen.  Pretty granular if you ask me.  There are going to be about 70 different screens.  Any ideas how this should be laid out?  I'm not sure whether the roles would be suitable or not.    The customer would like to pull up an employee record and simply be able to add/remove a "Create Employee Record", "Modify Employee Record" (2 different security rights) for an employee and so forth. 
 
Thank you
...