HR roles in Development system

Question: Hi all

Our Company is implementing MM,FI and HR , in development system we have a modified SAP ALL for most of the functional folks, now HR has picked up , that want to restrict HR transaction from the common roles and assign new HR roles to HR functional folks, i would like to know

1.If we make all the HR objects inactive from Modified SAP all will that suffice stoping FI and MM functinal folks from accessing HR area/tcodes?
2.I know there are SAP provided templates for HR for config people , would like to know what would be the ideal role for config people of HR
3.Are there any extra restrictions thats needs to be done and which areas does it clash like in WF
4.Any other hints and experiencs in this will be helpful

on a whole whats the best practice in doing this

thanks in advance

Answer:

1.If we make all the HR objects inactive from Modified SAP all will that suffice stoping FI and MM functinal folks from accessing HR area/tcodes?
Pretty much. You may miss some integrations (travel expense etc)

3.Are there any extra restrictions thats needs to be done and which areas does it clash like in WF
Not much
4.Any other hints and experiencs in this will be helpful
on a whole whats the best practice in doing this
Don't sweat security in configuration environments. Don't cripple the productivity of high priced config talent with mickey mouse restrictions that are not responsive to any real risk.

Answer:
its what the half known company guys want to and we need to do it ,