I know how to create a user role, what I don't know is which things to toggle on and off.  It could take a thousand toggles to get the right setting which requires logging off, then logging in with the user's credentials to check and see if they have the right permissions or too many permissions (ability to drill down to payroll data) etc.  Then logging out of the user and back to admin to try another toggle.  There's no where I've found that describes just what you're turning off and how it will effect reports, etc..  If you toggle off payroll, then when you run a profitability report none of the payroll expense shows up in the "Actual Cost" column which inflates your profit.  There must be a way to set the permissions that will allow for the payroll expense to be included in the profitability reports but not allow drilling down and not allow access to the payroll module...