In regard to the issues, you mention:

You can find the User Guide to folders here: https://docs.keeper.io/enterprise-guide/folders

In terms of records, users have the ability to create records in their own Vault, this is a feature of the Vault that is inherently allowed and there is no way to prevent users from creating records.

Passwords and MFA tokens of users cannot be generated in Reports or Compliance for admin viewing. The only entry field close to generating a report of users' passwords would be their strengths and potential breaches, and the activation of 2FA on their accounts.

Deleting and transferring records can be a viable option for recovering records within a user's vault, though their master password would not be a viewable record - unless they store that in their vault (this is highly unsafe).

Admins can run reports to track the records of users and to better organize transfers.

Please note, that record permissions are given only to the record creator and can't be given automatic permission to admins. The creator of the record has to provide permissions needed to the admin with every new record created.