Security roles should be based on job functions, not individual users. A role such as Sales Manager can be reused for everyone performing that function.
Person-based roles create security-role sprawl and become difficult to understand and audit. When Anna leaves or changes roles, it’s unclear whether “Anna’s Role” should be deleted, modified, or reassigned.
Function-based roles are easier to maintain. When Anna changes positions, simply remove her from Sales Manager and assign the appropriate new role.
Example: Instead of creating separate roles for Anna, John, and David, create one Sales Representative role and assign it to all three.
Interview tip: For one-off access beyond a user’s normal role, consider record sharing or teams instead of creating a person-specific security role.
