Best Practices for managing permissions in Visual Builder Studio?

An issue that we are facing at the moment is that it is a constant game of cat and mouse to ensure that only the correct people are org admins. We have a large distributed development team so controlling it is quite difficult and the risk that we have is that the CI/CD pipeline guardrails become meaningless due to excess permissions they have.

This is caused by the following seeded roles in Fusion automatically also giving access as a VBS org admin:

• Application Administrator (ORA_FND_APPLICATION_ADMINISTRATOR_JOB)
• Human Capital Management Application Administrator (ORA_HRC_HUMAN_CAPITAL_MANAGEMENT_APPLICATION_ADMINISTRATOR_JOB)