1. Navigate to Settings | Security | Security Roles.
2. Create a new role called Base UI User.
3. Assign the security role to your root Business Unit.
4. In the Core Records tab, add the following privileges:

5. Under the Business Management tab, add the following privileges:

6. Under the Customization tab, add the following privileges:

7. Create a new security role called Read assigned to the root business unit with the following read privileges to the account and contact entities under the Core Records tab:

8. Create a new security role called Write assigned to the root business unit with the following write privileges to the account and contact entities under the Core Records tab: