Permissions With Views And Tables

We are attempting to implement security on top of a shrink-wrapped software
package and are trying to get row-level security. Here's the scenario:

1. Table dbo.BOOK contains all the information about books in every
department.
2. There are a large number of developed reports that run queries like
"select * from BOOK..."
3. We wish to have each Department only be able to see their books - without
changing the existing reports.

Our thought was to create a series of views:

create view Dept1.BOOK as
select * from BOOK where Dept=1

....

and then create Roles for each Dept. We'd then remove rights to dbo.BOOK
and grant rights to DeptN.BOOK as appropriate for each role. We started
testing this and seemed to get it working, but are now having problems. Is
this possible? Is there another, better solution?

Thanks!