One approach is to keep roles as simple and broad as possible, then use groups or categories for more specific access needs. That has made permission management much easier for us.