Assign all user rights individually
"Thanks to the expansion of user rights allocation, administrators can now assign rights to each employee with considerably greater flexibility. Rights can be structured using dependencies, and in addition to creating various assignable sets of rights, individual rights can be granted or revoked in line with employees’ respective areas of responsibility."
That’s what it says here in the forum. Unfortunately, it’s not entirely correct. There are apparently certain permissions – such as the ability to delete a payment request – that are only granted to admins. These permissions cannot be assigned individually.
However, it should be possible to assign all permissions individually, rather than making some of them role-dependent.