Once Frodo logs in, he will be using only a single privilege set for that file. Each file has its own account/privilege set security. So one option would be to use separate files, and give him the desired privilege set in each one.
However, I'm guessing that the way you asked the question may not actually be what you have in mind. What you should try is creating your own privilege set, and then enable/disable field and layout access as needed. IOW, a single privilege set can give "full" access to one table, data entry access to another, and read only or no access to others.
I put "full" in air-quotes because if a user has an actual "[Full Access]" account, everything is open.
Menus can be limited by privilege set, and by custom menus. With the latter, you'd use a startup script to install your limited menu set as the file default.
Fitch, how much of what you just said applys to Filemaker Pro 11?
All of it applies clear back to FileMaker 7 (except custom menus, which were introduced in version 8).