Securing a Web Application at the Data Access Layer

Please consider the following setup:

• Multi-tenant webapp.
• Tenants create company accounts, and company accounts have user accounts.
• Users have roles, there is a special role "Owner" (the user who created the company account).

I would like users to edit other user accounts (some admin tasks), but two conditions must be met:

• No one can edit the owner's data (except the owner, when he edits his own profile and his own editing of the profile is the same user edit).
• Users can access user data and edit users only in their company account.

The application uses MVC architecture. I am currently checking these two conditions on the web tier and it works for me, but I have some problems. If I go with some kind of API or some other data type, I may "forget" to revise these conditions. In addition, there will be other objects in the application with similar functional requirements, and they will have similar restrictions, so I'd better come up with some kind of template that enforces my data access restrictions.

Can anyone recommend an approach worth looking into?

Thank!