Business-focused custom software

The last few weeks I've been setting up some third party software in a test environment so that I can do some development work on it. The software is an enterprise CRM, with a myriad of features and options.

One feature of the software is its complex security model. Permissions can be set at a very detailed level: on each table, report, query, etc. Permissions are tied to groups, and users can be associated with multiple groups. Also, permissions are identified by different connection types (for instance: a LAN connection vs. a web connection.)

The end result of these options is a lot of confusion and wasted time. I've spent literally days trying to resolve security/permissions related problems so that I can get to the point where I can do my job. It would be funny if it wasn't so frustrating.

I'm left wondering why the security was designed the way it is. From my standpoint, it is the most user unfriendly situation. I suppose it is possible that they were trying to handle every scenario, but it seems to me that they must spend a significant portion of their support time helping users solve security related issues. (They've had to help me multiple times for multiple issues.) Wouldn't their time be better served doing something else?

This is an important lesson when designing an application. A zillion different features and options are not necessarily better. Your software doesn't need a lot of configuration options and end user choices. A few key features designed elegantly will serve your customers better than a myriad of choices that just confuse everyone and add to the support burden. Stay out of the feature tar pit and just say no.