Loading
Because permissions are set reactively. Somebody needs a report, is given broad access to produce it, and keeps it forever.
Within two years a dozen people can see salary data because of a request nobody remembers, and the only audit is somebody's memory.
Work from three questions: what does a manager need about their own line, what does a manager need about people outside it, and what does anybody need in aggregate rather than by person.
Most reporting needs aggregates. Give aggregates rather than record access whenever the question can be answered that way.
Down as many levels as you permit — usually direct reports plus one.
Yes, which is how salary is separated from the rest of the record.
Yes, with who changed them and when.
Half an hour with your own data usually saves reading three of these. The guides will still be here afterwards.