How does role-based security work in Dynamics 365 Finance and Operations, and how should duties and privileges be designed?

Dynamics 365 Finance and Operations uses a role-based security model to control what users can access and perform within the application. Understanding the relationship between roles, duties, privileges, entry points, and permissions is essential when designing enterprise security. Poorly designed roles can either restrict legitimate business activities or provide excessive access. How should security teams design duties and privileges around business responsibilities, segregation of duties, least privilege, auditability, and maintainability?