We have a central Gearset Owner who setup our various orgs using a dedicated Integration User in each org. They then shared the connections with Gearset Users so the credentials remain hidden.

However, this only delegates metadata deployment entitlement, not data deployment. To allow data deployment, a User needs to remove the shared connection and set up the org connection themselves.

Data Deployment Entitlement should be managed as part of the shared connection, as well as Metadata Deployment Entitlement. This will maintain the ability for central management and also keep org credentials secure.