Roles and Segregation of Duties

Greatings, I have Symantec DLP 14.0 installed and am working on documentation of the different roles (including permissions) and responsibilities and am looking for a wheel that has already been created instead of re-creating it.  What would be desirable is a list of the various roles that you use in your environment from incident management, policy creator and infrastructure management.  The goal is that none of the roles have complete access to create\update policies AND ability to enable\disable policies, view and manage incidents AND not able to enable\disable policies, etc.  Keeping segregation of duties as number one for auditing and best practices.  What are people out there doing?  Thanks in advance!