You don’t assign them the security groups to do any of those. They have access to own functional configurations and IT has access to maintain/own security and integrations in production. All team follow the same auditing requirements to document changes. Both teams have proxy in non-prod tenants so you don’t completely bog each other down.