[Studio] Admin should be a specific permission in Canvas Permissions
*Any* kind of root admin gets *full* Studio admin permissions. This means that if I grant someone a limited permission such as the ability to post a Global Announcement, they will automatically be a full Studio admin. In our case, we have a role on the root level that only grants the "Act As..." permission. Every single one of those people has full Studio Admin access. Also, per https://community.canvaslms.com/t5/Canvas-Ideas/Studio-Admin-Permission-Inheritance/idi-p/603644 these permissions don't get removed. Also, instructure.com support gets full Studio Admin permissions. We have over 250 Full Studio admins, any of whom can change a global setting or mess with anything, with no audit log. It's a security and privacy nightmare.
At the very least make it so that only Account Admins get Studio Admin permission, or better yet, map Studio Admin to a specific Canvas permission.
admin
