I'm in the process of writing Access Control tests for a system in the Utilities industry. A component of the system is accessed depending on the role of the User (Role Based Access Control). There are two layers of Roles - The top layer is an Organisational one. i.e whether the User accessing the system is from an organisation that supplies Electricity, Gas or is a maintainence company, etc.... The second layer of Access control checks the Job role of the user, for example whether the user is a Call center user, a engineer, a Customer Service agent, etc... This latter level of Access Control is set by a Power User in the organisation. Access is controlled to around 15 sub components within the system, some of which can be accessed by a particular user and some of which cant. Some of the components also link to one another.
To add, a user can be a member of multiple organisations (for example a Gas Company and a Electricity Company) and can have multiple Jobs within that organisation (a call centre agent and a Service manager). With all this, permissions will be set cumulatively.
I'm writing tests but I'm not being strategic in designing my tests, which may mean I have too much coverage (duplication) or maybe not enough.
With all the different permutations, what is the best way of designing tests for this system which is to be tested manually?