restricting users privileges and logging their activities

Hello,
I'm administrating new installed cluster that runs Legato Networker and Oracle 9. And I want to restrict the use of root to my self and givr the application and DBA the proper and needed privileges to do their duties without hassle in addition I would like to log users activities.

my questions are:

  1. is normal user will give the oracle dba and legato networker enough privileges to run the application specific command?

  2. which is better in all terms sudo or RBAC?

  3. do I have to enable BSM to log the users activities if I used RBAC or I can syslog do that?

Thank you