[shoo]

megacorp; laptops have much enterprise security & surveillance bloatware installed. whirrr, such cpu fan, very compliance. by default no one has local admin rights for their work laptop. developers are approved local admin rights upon request.

once blessed with local admin rights, developers manually invoke a utility to grant themselves temporary admin permission for a limited time period each time they wish to sudo. this sounds worse than it is in practice, provided one doesn't need to sudo continually.