I have a query re OS security roles.

That is the main problem when you only have environment. The security is applied to all apps in that environment. You'd have to take the person out of the Administrators role and set more granular security by application. I am not a fan of the one environment model at all.