I need two types of users to access and modify some models: user and manager.

I have already defined security groups, but there crud permissions are applied on per-model basis. But I need to do it on per-field basis, or just turn a field to read-only based on user groups

Both user and manager must be able to read (see) and modify the records of a model. But user should only be allowed to edit some fields, while manager should be able to edit all of them.

Also, I know how to apply groups on fields in a view, but that prevents user to actually see the field, and that's not what I need.

How do I manage this situation?