Permissions should be set on a by user lever by allowing user roles to be edited beyond three strict categories. The permissions are not reflective of practice in many organisations a Payroll Assistant user should be able to finalise payroll but not edit the settings and configuration of the system for example.