Well, as I see it, you should have your different services documented, each service could essentially have different kind of levels of access. Depending on that service.
Isnt someone "responsible" for each service, they should be able to specify what different levels they'd like to offer to different people.
- -
Regarding the point of "verifying" a user, I guess it'd be good to have some sort of "mentorship" or "apprenticeship"-thing where someone will be their contact person in the desired project/group they get involved with. This person is responsible to approve/disapprove the new person. To verify both their knowledge and wether or not they can be "trusted". Not that the information in oVirt perhaps is something secretive but yeah, I think you get it.
- -
Now, who has root? Well, essentially, this ought to be a very limited set of users. Now, I've got lots of experience from organisations of different sizes. And it truly goes the wrong way as the number of people with root access increases. Mainly because some just arent knowledgeable enough to be entrusted with such an access. They put the systems at risk all the time. Which is bad.
- -
... Well, these are just my thoughts on the subject. I guess I fall into the category of people that want to be accepted into the "infra team". But still, the above is the basis I'd like to see in any organisation.