Start with responsibilities
Map permissions to the work a role actually performs. An agent answering tickets may not need billing, workspace, or developer access.
Respect the owner role
The Owner role remains fully capable and cannot be weakened like a custom role. Keep ownership with a trusted accountable person.
Test a changed role
After saving, verify the navigation and direct page access with a suitable non-owner account. Hidden links are helpful, but the server-side permission remains the control.