An internal application lets a staff member create and approve the same request because both actions appear on one convenient screen. Before building, define who may make each decision.
Map actions, not just job titles
List the tasks: submit, edit, review, approve, export and administer. A person may hold several roles in a small business, but the software should still apply the intended rules.
Some permissions depend on the record or relationship. A manager may review their own team's work while another role can inspect organization-wide summaries. Keep these conditions explicit.
Test rejected actions too
Acceptance should include what an ordinary user can do and what the application must refuse. Check direct links, file downloads and background requests, not simply the visible menu.
Plan role changes and departures. An administrator needs a practical way to remove access and reassign current work without rewriting the historical record.
Bring the actual responsibilities and awkward cases to the project discussion. A clear action map helps the application support the business's decision process while avoiding broad access granted merely because it was easiest to implement.
Include a temporary delegate in the examples. Someone covering an absent colleague may need a bounded permission that ends without leaving permanent access behind.