The recommended practice is to start a project with setting up the following business roles and assigning them to individual users. Assigning user groups or user roles directly on to the user should be avoided since it is a lot more difficult to maintain and keep overview for big group large number of users after GO LIVEgo-live.
These are the very typical roles that projects have:
System Admins (= “All Roles”) - for “all roles”) – For configuration engineers and System admin from the customer)customer system admins .
Price Analyst (for Price BuilderSetting) or Sales (for Quote Configurator) - the ones Quoting) – For users who initiate the price/discount changechanges.
Pricing Manager or Sales Manager - – For users who typically approve prices/discounts and have access to dashboards.
This will help you test and fine tune the finetune security from the very beginning and avoid cleaning permissions before UATuser acceptance testing.