Stop the admin roles from showing up in the Agent Permissions when you are granting access and separate these into different sections in the permissions so it is clear what type of access is being granted and from where. The Account-Wide Permissions should be similar to the Roles and also ask what workspace or if for account wide but be changed to admin access.
I do not understand if when creating the roles they are separate but then when granting them they are together. It makes it silly to administrate and relies solely on the logic of naming the roles at the end Agent of Admin to keep track of which is which.