How do you handle permissions for your private container registry without giving everyone admin access?

we're a team of 6 devs, 3 ops folks. Our Harbor setup is either admin or read-only, no middle ground. Devs need push access for their services but keep accidentally nuking shared base images.

Currently using service accounts per team but it's getting messy with 20+ repos. Jenkins pushes with one fat service account that has way too much access. Thinking rbac per namespace might work but curious if anyone's done this at scale.