Start from the trades
List the real profiles: salesperson, manager, external partner. For each, note what they view and what they change. The resulting table becomes a reference for the whole project.
Check on the server
Hiding a button protects nothing. Every action is checked by the server, whatever screen triggers it.
Plan for exceptions
Cover during holidays, temporary access for a contractor: special cases always exist. See our approach to application security and customer & partner portals.