I want to suggest adding the option for a single user to have different roles for different client groups - i.e. for Group A they have a Bookkeeper role and for Group B they have a Scan Only User role.
This will be very useful if a user has a primary role over one set of accounts and should have robust access & functionality, but a minor or secondary role of a second set of accounts and should only have very limited access to those.