You should start enforcing security at the most granular level as soon as possible. Roles help in this regard - giving people access to a number of tables at once isn't a nightmare.
The single account for everybody is a great source of questions here and elsewhere - "record x was deleted, how do I find out who did it?" - the answer is you can't - without individual accounts and auditing.
By "auditing" I mean that while it's all very well having an account for everybody, that doesn't mean that you have true security. If, say, a record in the HR table is deleted, all you can tell is that somebody with access to the HR table did that - that's x number of people.
You need triggers in your system which log actions to be able to track down to the individual level who performed action X (unless you have an RDBMS such as Oracle where this can be made automatic).
In any case, you should always make your security as granular as possible as soon as possible - give people access to tables only on a "need to know" basis. And, always include timestamps for actions to tables - people frequently give their ids to others - if you can say, "Jimmy, you were the only one in the office at 17:49..." - again, it's not ironclad, just another arrow in your quiver.
Maybe if you gave us your RDBMS, you could obtain advice more specific/relevant to your situation?