We're running multiple, diverse projects with separate permission schemes such that those with jira accounts can see only those projects for which they have permissions (and any projects with world-readable elements). No one in any of the groups associated with a particular project has global jira-administrators privileges, though the small, central, jira-administrators group does have admin and browse permission in all permission schemes.
The project leads of the various projects have varying needs as regards workflows, notification schemes, etc. As it is now, the central jira-administrators group needs to create workflows/notification schemes and assign them to the various projects. As far as I can tell, there is no way to delegate workflow/notification creation and editing to any person or group other than jira-administrators. Since jira-administrators creates the scheme and then assigns it to a project, it seems, on the face of it, reasonable to be able to allow project leads/project admin groups to create their own workflows/workflow/notification schemes from the get-go and edit them from there on.