The System Customizer role allows users to create and modify customizations (entities, fields, forms) but restricts access to the data within those entities unless they created them. This adheres to the principle of least privilege for app creators. Conversely, the System Administrator role is the only one that possesses "All" access across all records and system settings by default. While both roles can customize, the System Customizer cannot view all stored data, making it the correct choice for the first two requirements. Only the System Administrator has the inherent permission to view all data stored in system entities.

Microsoft Learn Documentation: "Predefined security roles - System Administrator and System Customizer." Section: Security roles and privileges. (https://learn.microsoft.com/en-us/power-platform/admin/database-security#predefined-security-roles)

Microsoft Power Platform Admin Guide: "About security roles." Paragraphs detailing the differences between administrative roles and customizer roles regarding data access.

Microsoft Learn: "Create or edit a security role to manage access." Document ID: admin-security-roles-privileges.

Dynamics 365 Implementation Guide: Section on Identity and Security, focusing on the principle of least privilege in environment administration.