High Level Permissions For an Application Owner
A short answer

I had similar issues when I was a BI DBA, trying to control deployments without blocking the business needs.
And generally prevent yet another badly coded csv-parsing function to add to the current 13 or so already pushed to live.


You don't need sysadmin to deploy
Depending on exact need, you need one of ddl_admin/ALTER SCHEMA/db_owner


This way the scope of a screw up is limited to the database and/or schema.

ALTER SCHEMA is very useful for limiting changes and I've done this before.

Do these folk needs to modify security for example? Most likely not.

I'd also implement some kind of DDL auditing (I have a server level DDL trigger) that writes to a DBA-only database. This way all DDL is logged