Ask HN: What do you like or dislike about team/org domain name management?

I've used the two most popular domain name providers, GoDaddy and Namecheap, to manage domains. Both leave a lot to be desired, particularly around teams & permissions, that I'm considering to build a product around if others have similar problems. I'm curious if you have the same problems and what products you're already using to solve said problems.

Here's my list:

1. For eng orgs of 50+ people, I'd like to setup an org that folks can SSO into via Google/SAML/whatever to acquire new domains under said org. This would include tools like an approval workflow so that a security or purchasing person can approve requests to buy new domains.

2. I'd like to have better ACLs for managing the DNS records of said domains. I think AWS, Google, Azure, etc. have some levels of this in their products, but setting it up isn't for the faint of heart. I'd like to see something that's more "baked" and simper to manage permissions around administering DNS records. e.g. I could have a policy for `*.example.dev` domains that let folks grab whatever sub-domain, but maybe only a few people can manage `www.example.com` records with the approval of another admin (like the two-key approach to launching ICBMs)

3. I want a CLI. It's insane that I have to fire up a browser when I want to change DNS records.

I think https://dnsimple.com/ comes the closest, and possibly solves most or all of these problems. Its really hard to tell from the demo or trial, which is why I'm asking here.