Start from an existing role
Never start from nothing. Pick the built-in role closest to what you want and adjust it — you inherit a sensible baseline instead of assembling one checkbox at a time.1
Duplicate the closest built-in role
Want a “Foreman who can also approve tickets”? Start from Foreman.
2
Name it for the job, not the person
“Field Approver,” not “Mike’s role.” Mike will move on.
3
Change only what you came to change
Then stop. Every extra permission is one you’ll have to justify later.
4
Read the matrix row by row before saving
The matrix is a grid of what this role can do in each module. Read it, don’t skim it.
5
Test with one person for a week
Before you move thirty people onto it.
Reading the matrix
Next
Field-level permissions
Finer than roles, per form field.
AI and voice
Talking an RFI into existence.