Different rights to different groups

It would be very useful to be able to have different access rights for different groups. For example we have a best practice team and a manager for that team. The manager needs to be able to do certain things for the team such as updating salary. They also have another role which is to ensure that all employees adhere to certain policies. It would therefore be great for us to be able to assign another set of access rights to them which would allow them to update a logbook for all employees. Obviously at the moment we can't do that as either they will get update rights to all employee salaries, or they have to lose the ability to update the salary of their team, etc. I think this dual role for access rights could prove useful elsewhere as well.