Hi Damien

These are just a few thoughts.

In standard Sage CRM, Quotes and Orders are treated as extensions of the Opportunity entity rather than as separately securable entities. Therefore, a user’s ability to view, create, edit or delete Quotes and Orders is generally inherited from their security rights to the related Opportunity.

You can refine access by using Company or Opportunity Teams and by applying tab sensitivity so that the Quotes and Orders tabs are displayed only to appropriate users, teams or profiles. Sage CRM presents related information through entity tabs, which can be controlled through customisation.

However, hiding a tab is primarily a user-interface restriction, not a complete data-security boundary. Where strict enforcement is required, additional customisation should validate access when the Quote or Order screen is opened, including access through direct links or custom integrations.

Whilst true security access is based around the Security Profiles. 

You could grant access via Security Profiles, but then hide the Tabs, and the New / Find menus if that works better for you. 

E.g. on the user account you could created a custom checkbox field (e.g. user_c_AllowQuotes) and then on the Quotes tab on Company / Opportunities, and then the New / Find menus, edit the settings of them and in the SQL box in those screens put in user_c_allowquotes = 'Y' 

The tabs / menu options will then only appear to the user if the box is ticked on their user account. We have used this to hide/show something before where Security Profiles doesn't cover the ability