>In my opinion there's only one way to do this. Admins who are all powerful, and non-admins That's the best way to do it when you can trust your admins, but it

>In my opinion there's only one way to do this. Admins who are all powerful, and non-admins That's the best way to do it when you can trust your admins, but it violates Sarbanes-Oxley. I've seen some places that literally have a chain-link fence with a pad-lock in their data centers to separate access. Obviously that's suboptimal for efficiency purposes, but anyway.