Who manages what? WAF, PAM, etc.

Trying to find out, in a properly segmented large company with a separate IT department and Security department, who would manage what platforms? There are some that sort of cross over, so would both manage them? Who would have more rights? I tried looking for a best practice guide but couldn't really find anything that clearly outlines this.

WAF: would Security handle only the security rules and leave everything else up to IT? Agent deployments?

PAM: technically Security shouldn't have …

best practice cybersecurity department etc find guide large manage pam platforms practice rights security sort waf