Hi Julius
The major downside of derived roles is that the will all be exactly the same, except for technically defined org level fields.
Quite amusing - as I would normally say the "The major positive of derived roles....)
It comes back to the client requirements and understanding the design. I did interpret Anwer's need as just changing org values (but it is not 100% clear even in his last comment to me)
I like your idea of pilot go lives and needing to make changes. Then, there is always the situations of regional access (SAP standard for specific countries) and custom transactions for specific companies only that is a challenge. In the sites I've been on, they have built an additional role. The trade off was to protect imparting/derived at a cost to additional role assignments. Part of this decision is whether the business process owners and functional consultants are enforcing standardised processes across all companies.
Eventually one comes to the conclusion that derived roles are actually a pest.
In your approach, are you then having to use your own custom tools to manage mass updates to roles? If you are on a site that has 50+ plants and you need to build access by plant, wouldn't that mean 50 role updates for you if you needed to grant them a new permission?
Regards
Colleen