The recommended practice is to start a project with the configuration business role and a customer business role and assign these the business roles to the users instead of assigning user roles individually. It will help you to test and tune the security from the very beginning.
Page Comparison
General
Content
Integrations
App links