Database Security

Hello, everyone, I've been given the task of developing a security plan to control database access. I'm considering creating a set of roles for each database, based on the business needs for each one (i.e. a read-only role, a read-and-insert role, etc.) My question is, have any of you ever implemented something similar? If so, what were the benefits and the pitfalls? I am very interested in hearing about your experiences. Thank you