I have a group of users set up with profiles only. These give them too much access. I am to change them to roles that limit their access to the job they do. I am new to SAP and the co, and it is small co, our staff is is 3. My plan is to work with the user's managers to see what they do on their job and what transaction they do. My new manager says this is not the appropriate way to do it, find a different way. Any suggestions.