Split the P&D role into two, rights to Create packages and another to Deploy packages. This allows for more granular control as the ones building apps (Cit Devs/Devs) will also need to create the packages to be promoted to the other QA/PROD etc. but should not have permissions to deploy packages (Ops/App Managers).