While the question is old I feel it still hasn't been answered. I myself have been setting up an e-commerce CMS project for the last few days and learning the basics of Zend Framework coming from a silver light Prism background. One thing that I can suggest is to understand that a module doesn't need to be small. The very definition of a module is "An independent self-contained unit" so in your case you'll have a "BookingModule" that when finished should be able to be chucked into any application and then with the proper tie ins can communicate with other modules. The issue with your layout is your relying on the modules to separate your different levels of access (which in a reply you basically ask "how should I do this"), what you want todo is use some sort of Authentication method to see if the current user can run a specific action. Off what you've given us I'd suggest a role based authentication method with maybe multiple actions (still deciding this part for myself).
Zend Framework
- Hosts an "Application" which contain modules that utilize MVC
Module
- An independent self-contained unit that can be plugged into any application
- Can have hooks/tie-ins to communicate to other modules within an application
MVC
- Models: Insure Data integrity through Validation verification
- Views: Displays the Model's Data to the user
- Controllers: Process user input through Actions that edit Data
- Action: Security logic should go here, to ensure the user can use this action.
Role
- An Enum for use in Authentication
TL;DR
For your project you should have 1 module, 4 controllers, 3 roles and an authorization Service tied to your controller's actions to verify the current user can run said action. This'll prevent repeating code and also allow it to be expandable without any code rewrites.
Read this to understand Authorization on Actions:
Activity based checks
Edit:
Should probably note that there is nothing wrong with making each one a module as it is workable, its just more work to tie in and more coding with the only gain being you could pull say the Bookings Module into a completely different Application without the need for the other 2. But from my understanding you just want 1 module