Answer
Work on defining the permission sets in parallel with the implementation itself, rather than trying to finalize them upfront — during the concept phase, it's generally recommended to give full access to the active users/persons actually involved in defining the processes, since restricting access too early gets in the way of exploring and agreeing on how the business processes should work. Only once a process has been agreed on and tested should you have those same test users try it again logged in as a more narrowly-scoped test user-id, built specifically to validate the permission set you've designed for that process — testing the permission set is a separate, later step from defining the business process itself.