I use an Active Directory Web Service to identify each form user's domain
credentials and also query any data in AD such as email, phone, department,
manager, location, etc. This eliminates entry for the user and ensures
accuracy.
You can even use group membership in your logic.
User permissions can be set to control either via the file structure or
within the forms what access they have to what forms.
If ytou would like to see a demonstration of common architectures and some
examples you can contact me here.
http://www.infopathdev.com/members/clayfox.aspx