[IDEA] MWS Built In Roles
One idea from that issue that isn't yet implemented is the idea of recursive realms, where an owner would give a manager permission to edit the ACL for specific users within a specific space.
It would take a bit of thought to work out how that would work.