The right modules, nothing more.
On top of the platform role, each person gets a permission level per module, from none to admin, so a field tech can update jobs without touching payroll, and accounting can run the books without editing marketing. Access maps to the job, not to one blunt on/off switch.
- Levels from none to admin, per module
- Least privilege by default
- Access reflects the role, not a global toggle