Also literally separate domains in the sense that one team probably owns authoritative DNS for fbcdn.com and another probably owns facebook.com. with a big inf

Also literally separate domains in the sense that one team probably owns authoritative DNS for fbcdn.com and another probably owns facebook.com. with a big infrastructure, it would be negligent to allow everyone permissions to edit a domain like that. But you probably want to do permissions more like an org chart and less of a hand curated list of people who both have business reason to edit and steady hands/full understanding of DNS. Lots of big infrastructures are pretty much put together like the internet.