Least privilege
Grant each role only the groups of actions it actually needs.
Hierarchy
Luméo cannot act on a member or role positioned above its own role.
Testing
Test with a moderator account that does not have the Administrator permission.
Review
Remove access that is no longer needed after every team change.