How to tie capabilities to custom roles so certain options are hidden based on the user logging in?

We've built a heavily customized OEM Application for our product and I would like to know how to make certain things aware of the user role and hide/show them based on who logged in. The example would be: - I have a button on reports that allows a user to create a new firewall policy based on the the row in the alert/report. - I would like the capability to have this grey out or even just be hidden if a user is logged in as one person versus another. - I suppose I could do this by creating 2 apps (admin and user) and just making the right one the default for that user and the other not accessible to the other, but this is not as elegant and adds a lot of complexity to our distribution. Thanks!