Rippling does this by having roles assigned to groups, and groups receive sets of permissions and access to different apps. Builds all this into one click.