Add additional role separation for developers and deployment admins to allow developers to build plans but not deploy. This allows the developers to build the plans as they are the ones that know the resources and actions required to migrate their changes, the admins will not have this knowledge.
Add some roles authorizations that can be added that allow you to designate a certain group as deployment admin vs developer. Admins can then review the developed deployment plans and resource bundles and either execute the plans or make mods or get the developer to clarify the intentions.
I would like to have 3 roles:
Developer role to build plans but not to deploy
Deployer role to deploy the plans for his project only
Admin role who has full control
Why:
Developer role as described above
Deployer role, because I want to delegate this to our business and give them autonomy to deploy when they need to (following CI/CD principles)
Admin role for obvious reasons
Supporting different Roles is already in the system, it shouldn't be an add-on. However cumbersome it may be is a design choice but no one ever said software development was easy. It should enable the ease of use by the users otherwise what is the point of having it - not how easy it is for a developer to implement :-)
I think it would be good to coordinate among developers and admins regarding deployment of resources.
Also developers can create migration sheet mentioning permissions and resource list which can be provided to admin and they can deploy the same.
Creating a different role would be cumbersome and would be an add-on