How to implement Access Control List?

If a client can only belong to one specialist, then you'll want to add a specialist_id to the clients table.

If a client can belong to multiple specialists, then you'll want a mapping table:

clients_specialists
client_id | specialist_id

Then on your CRUD pages before you let them edit anything, you can check your tables to make sure that the client actually belongs to the specialist.

PHP Code:

if( $this->specialist_model->has_client( $client_id ) {
    // show form
}
else {
  // show error
}