Employee access to projects, time and expenses

Someone with the role of "employee" should only be able to create / view those records that relate to them.  An employee shouldn't be able to view the time sheets, or expense claims for other employees.  Employees should also be able to select a project for a time sheet or expense claim, but they shouldn't be able to run report associated with a particular projects.  Access to any reporting should be able to be limited based on the users "role".  At the moment an employee with Timesheets & Expense claims and projects access can run the "projects" report and see the income and expenses for any project.