Assigning roles appropriate for these users should be separated from the account's platform administration engineering team who need what's called "Admin" in canvas.
We are a large institution with varying roles and responsibilities spread across our central support teams, faculty support, school support, central disability support teams, faculty administration, school administration, central development team, learning and teaching support, L&T dev, analytics views.... you get the idea. Separating those who work "on" the platform is important to be able to see who's able to modify the platform against those who have globally elevated privileges.