user roles and authorization

Dear All,

How do we decide upon the roles requirements in EM ? Ideally what all roles should exist in production environment ?

Suppose if we want to provide an access to EM portal only to the third party vendor via EP Portal such that EP portal has link to the EM portal.

How do we authorize the vendor to access the records only relevant to him ?

Thanks,

Shubh.