What do you think is the best way to promote and duplicate a package? The idea is that development promotes a package to qa, and qa needs to be able to modify and play around with a copy of the package, but only be able to promote the original package to production (i.e., qa cannot modify the original package, but can modify a "sandbox" package).
You can setup RBAC to allow qa to duplicate the package, but the permissions are retained, so qa cannot modify the copy.
My guess is that you'd have to set up a separate role. Dev promotes two copies: one to QA and one QA Sandbox. Once QA finishes with the sandbox version, they can go back and promote the QA version.