One team owns the instance
A central marketing ops team holds the admin role; each acquired brand gets a role scoped to its own workspace. Field creation, the sync user’s credentials and anything touching the CRM sync stay central, handled as requests.