Step 1.
There is standard role, privileges system in esri, but there is no standard practice to fit all organization.
Each organization must depends on their situation to develope a pratice just fit themself.
https://doc.arcgis.com/en/arcgis-online/administer/member-roles.htm
Step 2.
For large organization such as USGS with hundreds of projects ( = city's department), with 5000+ users, my user number is 53xx.
If you give admin role to everyone, then someone did bad things. It is very difficult to find out who did that among 5000+ user's.
Admin role to everyone, let anyone can publish anything visible to public, sometime the layers they published can not represent USGS's viewpoint, or does not meet USGS's standards.
In reality, USGS gives me certain role, type ( I can not see my type and role, because I am not admin, can not see anybody's user type or role including myself).
I can create and edit and publish a layer, however, the layer I published isn't public visible. Public can not see the layer I published to USGS's arcgis online, only myself and admin can see the layer I published.
USGS developed a practice special for them to address the problem I mentioned above. I can add, delete, edit, publish only my own layers. I can not access or touch other user's layer. Anything I published to arcgis online is not visible to public, only visible to myself and admin. This is a good practice for 5000+ user's organization.
Step 3.
For small city, La Quinta, city manager is arcgis online admin. In myesri.com, city manager is also admin, he also let IT contractor Acorn Technology operate his myesri's admin account to download license, install license. He also use admin role to renew esri's contract.
Arcgis online, there is build in admin account, I operate this build-in admin account to do my work. Because of only 1 gis person, there is no need to think about what role I should give for other people. Planning manager use gis a little bit, I give her admin role, she barely use admin role. Years later, city manager office hire an assistant, he was given admin role on both myesri.com and arcgis online.com, but he is not gis person, he have to ask gis contractor vendor company to operate after I left.
Gogov is software vendor for city law enforcement officer. I work with vendor for city gis layers, including geolocation, geocoding, monthly parcel owner update.
All other gis user, don't even gis account, they rarely use gis, if they do, they will ask me to do it for them. They have no need to create gis account.
Step 4.
City of palm springs, Instead of city manager being myesri.com admin, assistand IT director being admin. (la quinta does not have a IT director). I operate the build-in arcgis online admin account to do my work. Only 1 gis person, that is me again. Other user are from different department, not gis person. Palm spring Airport has 1 frequent user. Planning department, historical site has 1 frequent user, there are less than 100 user total, most of them are not use gis often. They ask me to do simple editing for them. They never ask me to publish layer. I work with vendor Tyler software, for building safty permit license software, which depends on parcel owner, address monthly update. I work with fire chief, fire captain to get all business address and phone number, they are not gis person, they ask me to do it. Same as planning dept, they are not gis person, pretty much rely on me to do it. Engineering department and public work are same, they are not gis person, pretty much ask me to work on it. City manager office, for road closure, same situation.
In general, less than 100 gis user are not gis person, they are mostly rely on me to do gis work. So given them admin or not admin does not make any difference. They don't use admin role, have no need, don't know how either.
Step 5.
City of victorville, every gis guy is admin, every gis guy is admin on both myesri.com and arcgis online. IT director is admin on myesri.com. Initially I am only gis person with admin on both myesri and arcgis online. Later they hire a gis technician and a gis coordinator, all 3 gis person is admin. There are other less than 100 user, they are not gis person, they pretty much rely on me to do gis work. So given them admin role or not does not make a lots difference.
Step 6.
The problem if I don't give admin to gis user, they can not publish layer to public. They will ask me to publish. After I publish, I will be the one to blame if this layer should not be visible to public.
What if I give them admin role, let them decide if they should publish a layer to public. No one can blame me after. Since I have no control of their data.
Every department director should be admin, department director should decide who should be given admin in their department.
If some one did bad things, their department director should be blamed. For small city, only handsfull user, you never see people do bad things because it is easy to find out who did bad things after. Not like USGS 5k user, some one did bad things, and you don't know who.
For small city less than 100 user, generally speaking, you can give each gis user more power, such as admin role. Encourage each gis user to use gis. You don't worry about someone did bad things such as publish unwanted layer, it is easy to find out. Also their department director should be blamed at this situation.
If I don't give them admin, everything they have to ask me to do it.
I becomes the one to be blamed if they ask me to publish unwanted layers.
Specially when only have handfull gis user with very smal city, everyone should be admin, everyone self manage their data, just like in city of victorville, 3 gis person, everyone is admin. Even someone did bad things, it is easy to find out. No one want to risk their job security to do bad things.
Even some one did bad things, you still can easily recover from server backup or from database backup.
Step 7.
Should department director give admin to their employee? I say yes. Because if they don't, their employee will always need to ask director to publish layer. If some employee leave for vacation, or not available, the other employee can not take over the work. If given admin role, even some one is not available, other employee can take over the work immediately. Director don't have to bother to involve all these trouble, director just oversee this progress.
Step 8.
Step 9.
Step 10.
Step 11.
Step 12.
Step 13.
Step 14.
Step 15.
Step 16.
Step 17.
Step 18.
Step 19.
Step 20.