What is the recommended approach to separating and auditing Admin rights from common user rights?

Summary:

Thinking about Oracle Fusion Cloud… What is oracle's and/or the community's recommended approach to separating and auditing admin rights/actions from common user rights/actions? Is there a Break Glass like feature allowing a user to engage admin rights and trigger additional logging when admin rights are needed? Is the expected approach to create a separate/additional Oracle Fusion user account for people who need admin rights above their common user rights?

Content (please ensure you mask any confidential information):

Some examples of common vs admin rights are:

Admin Rights:
Payroll Implementation rights

Common Rights:
Accessing personal pay slip