We've had some issues with technicians who accidently put an organization wide or account wide rule in place when it should have been for an individual identity. Being able to split permissions would be the best way to do this, but since there is only one Security Engineer role, a notification of when a rule like this is put in place would suffice.