EPBCS Security and Role

Summary: How to effectively delineate separation of duties and control with the current EPBCS security model?

Content (required): Problem is that many different operational roles are requiring Service Admin rights in order to support EPBCS. Is there a best practice or new features in development to enhance the security model ?

Version (include the version you are using, if applicable):

Code Snippet (add any code snippets that support your topic, if applicable):