Would be good if you could make the whole system read-only, while there are major maintenance outages or if you are not yet live and only want people to access the system for testing purposes. Otherwise, you are constantly having to going through and updating everyone’s permissions - which is not feasible to an agency as large as ours. Plus also requires us to remember to update everyone and ensuring nothing is missed.
You should be able to say, make read only - except for these groups of people and people able to toggle it off and on again if needed for set up.