Ideally there should be more pre-defined permission sets that match common user roles (such as A/P clerk) and user tasks (such as everything needed for entering payables/purchase invoices vs. selecting and printing checks). This would be helpful to have as a good starting point for most clients, and would make managing security much easier.