Server Side Permissions API

My Bubble application has many levels of users and the levels are variable based on the client. For example, I have parent companies that can view all their own data as well as data from their child companies, and within each child company there are variable levels of executive level managers, senior managers, department managers all the way down to line workers. Each level of worker across all organizations need to be able to log into my application but only view/edit/update items they have access to. Some of what they have access to is based on their role in the company but there also need to allow for overrides for specific content for specific users. Because of the complexity of this permissions structure I would like to build an external Permissions API. I know I can call this API from the Bubble Server (i.e. server to server call) but how do I intercept the queries on the Bubble sever to include specific conditional logic to only show those items (i.e. rows in the Bubble database) the respective users should have access to? Is this possible?