We did the same some time ago.  We have an End User role that is granted to every user, it is a copy of the IFS FND_ENDUSER with some things (like Purchase Requisition creation) that we added in to it.  It also has a structure containing some other Functional and End User roles that are given to every user (including FND_RUNTIME).

This permission set is the one required to allow a user to login, so it automatically brings all of the other things that are considered Global to each new user by providing one single grant.

The main grants then needed for Purchase Requisition are under these Presentation Objects.

@ShawnBerk Yep, that is what we are trying accomplish but we also want to control who can save a newly created PR; we want that control to be in the “hands” of the company controller who has “normal“ operational user access.  This would take IT out of the decision loop and action loop.  How can this be done?

Ahhh, we do that with a sharepoint permission request form to first make sure that appropriate individual has granted permission for the user.  For us it is the department manager, for you, the controller.  But...we require that the responsible individual grants the access first.

I’m not sure how best to do that inside IFS, that is why we do it outside - before the permissions are setup.