Another option might be to allow a "rootless" mode in which direct access to the root account itself is impossible (but where there are still ways for non-root users to gain a subset of root capabilities).