That makes a lot of sense.
For our setup, our team is the data management team for our entire organization, so the SA, EA and Global Administrator rights would all be in the same functional area. So it is possible that myself and others on our team will share SA roles. For the plan 2 thing, I believe we are working on that.
My main question really falls within security business units. Since we are a city government and are largely decentralized, meaning large departments often have their own rule sets, I was thinking it would make sense to create business units as security groups within one environment. Then we could replicate that as a test and/or dev environment for testing, as you described below.
I've read a lot of different articles on business units, but I am trying to see if there are any potential drawbacks of using this structure that I am not seeing. I'm trying to prevent having a ton of environments since it seems like migrating data between them is quite involved.