Why not a flat permission list
Merging all roles and delegations into one global set of permissions lets one department's rights leak into another. The ERP moves to structured permissions: each permission is tied to a department and a scope.
Model
- 6 departments and 4 levels; scopes are: own records, assigned records, whole department, workflow participants, branch, and everything.
- The permission check takes a context (department, resource type, owner) and denies when the context is missing.
- Data lists apply the scope condition inside the query itself, and notifications use the same permission resolver.
Delegation
A delegation needs a reason, an approver and an expiry date; you cannot delegate more than your own rights; the highest roles and configuration rights cannot be delegated. These guardrails sit in the service layer and the database, not only in the UI.
Rollout
Done in phases: block bad input, run old and new checks side by side in shadow mode, then enforce by risk level starting with finance. The enforcement flags are switched on gradually and have a rollback.