Great points.

I realize this is no substitute for wisdom and experience, but I wonder if at least there could be a workflow to adding logins to the sysadmin role. In other words, a two-factor request would need to be fulfilled - (1) email or form to approve the request and (2) text message to a phone to cross-validate.

I know this could probably be defeated but until it was, it would put potential escalations in front of the authorized person before becoming active.

Thanks,

webrunner