Roles and permissions

Greetings to all,

I'm an administrator of a Moodle 3.11 shared between 7 institutions and one of my first tasks is to re-set the roles.
The current approach is to make everyone a site administrator, which as you can imagine is a bad approach. Less is more.

So I'd like to go back to 2 site administrators who can designate three types of managers:
- one to manage users (add/delete)
- one to manage SQL queries (some institutions use them a lot).
I don't like these two roles, as they offer access to all users, but I don't have a choice.
I think they'll be in system context, if I've got it right.

Where I will have a choice is for the third role, on the functional side.
Each institution is going to have a Functional Administrator, who I would like to have rights only in a root category (Our Moodle has 7 course categories for 7 institutions), so in category context.
Is this possible?

Then, this Administrator must be able to assign a secretary who will add/delete categories and courses (category context).
And this secretary will then nominate teachers, who will have full authority over their courses (course context).

Does this seem correct to you?
If I'm not mistaken, I don't use the user context at all? (I didn't understand very well what it was used for).

Thanks to you !

Rémi !