Can you show the screeshots what critical role is available to users with ‘administrator’ role, but should not be?
What do you name ‘superadmin’ role?
Did you allow to single site admin access to the network admin like manage_network_options, manage_network_users?
