Just the first question gives me shivers. The end user device is an entry point into any organization, of extremely high risk. PAM solutions, with proper loggin

Just the first question gives me shivers. The end user device is an entry point into any organization, of extremely high risk. PAM solutions, with proper logging and time bound limits to what needs to be done as root, exist and should be leveraged. Not everybody is Google, for better or worse.