Map roles to real responsibilities
List the records and actions each team needs, including viewing, editing, exporting and approving. Treat administrative configuration separately from ordinary daily work. Use representative roles to test important journeys: creating a lead, reviewing a project, issuing a document or reading a support ticket. A clear role model is easier to maintain than a growing set of exceptions assigned to individuals.
Review access when the organisation changes
Joining, moving teams and leaving all affect what a person should be able to do. Give those changes an accountable owner and remove access that is no longer needed. Check integrations and exports as well as screens, because hiding a menu does not by itself restrict the underlying action. Keep temporary cover time-bound where the configuration supports it, and review powerful permissions more carefully than routine record access.