Permissions are usually the last thing discussed in an ERP project and the first thing that goes wrong. Role modelling is cheap to do at the start and expensive to retrofit once screens, reports and workflows already assume a single flat set of users.
Model roles against the process, not the org chart
Job titles change more often than the underlying process does. Model permissions against what a role needs to do — approve a quotation, release stock, view another department's margin — rather than against today's org chart.
Design the audit trail alongside the permissions
If a permission model matters enough to enforce, it matters enough to log. Every write should be attributable to a user and a role, exportable for a future audit.
Retrofitting is the expensive path
Adding roles after screens are built usually means reworking navigation, reports and workflows that quietly assumed everyone could see everything. Get the model right before the first screen is designed.
Related service: .NET and Azure development.
