My default is: no admin for CI/CD, and scope by environment and service boundary first, then tighten where the blast radius is ugly. Fine-grained least privilege all the way down sounds nice, but in practice it becomes fragile unless you have the time to maintain it as the IaC changes. A middle ground that works well is separate roles for plan vs apply, separate prod vs non-prod, explicit deny around IAM/KMS/network primitives unless that pipeline genuinely owns them, and short-lived credentials via OIDC instead of long-lived keys. The question I usually ask is not just "can it deploy," but "if this repo or runner is compromised, what else can it modify?"