This is exactly what we did in our team, create an RBAC system to allow downstream teams to configure and request advanced stuff but with permission and logging

This is exactly what we did in our team, create an RBAC system to allow downstream teams to configure and request advanced stuff but with permission and logging. But then the immediate problem is that some of them has legitimate needs to modify the RBAC system itself! So we ended up creating as good as practically possible audit logging of the rbac system, tied intimately to a users authentication, and let them go wild. Worked pretty well so far (as far as we can tell that is).