How do you manage BPM approval groups with your JML process?

Currently we manage roles and permissions via auto-provisioning rules based on user job titles, and the user's membership on approval groups has to be managed manually. We manage this by having the users raise a ticket, then IT will amend the approval group members on request. This requires user diligence and they often feel frustrated about the intervention they have to do to have "all manners of permissions" provided to them.

Would like to know how others manage this - do you delegate this to super users to manage directly? Do you orchestrate these with other workflow management tool for JML?