Set access by role
An organisation might let support staff view orders and finance staff approve refunds. Each role has a set of permissions, and a person can have the roles their work requires. This is easier to manage than setting access separately for every person.
Keep roles useful
Roles can help with least privilege, but they need review. A broad role may give too much access; too many special roles become hard to manage. Update roles when jobs change, and pay extra attention to roles that let people delete data or approve payments.