Could you please tell me when you plan to really optimize the access right management.
For instance, for Purchase order one person need to have full control to be able to receive items. But if this person is having full control it means she can also approve purcahse order. If I want to remove the "approval" right, I've to remove "edit" level. But then the person cannot edit the purchase order, which means no right to mistake or update in case of new products.
It might be quite useful to have separate right for Creation, Edition, Approval, Items receiving.
It's the same story for Technicians who needs Admin rights to have access to reports part.