I'm going through this right now, taking editing rights off people. So hard when they are used to it!

So I will add this tip. Keep your user roles simple. Start with the principle of 'least privilege'. It is so much easier to add access than remove it.