Securing manager access to employee data

As a security measurement, the Spiffy Computer Company sets clear restrictions on how its managers can access employee data.

Specifically, the Spiffy security plan imposes the following security restrictions on managers:

Managers can retrieve, but not change, all information in the employee table for members of their own departments.
Managers of managers have the same privileges for their own departments and for the departments that directly report to them.