They handle the permissions ok but untested upgrades in own environment requires having enough staff. But IT has been losing system admins in favor of devops for cost savings. They deserve this.