I am currently developing a web application (in Ruby on Rails) for my university's department. The web application's user base have several roles:
director (the director and assistant director of the laboratory for the department),
lab assistant (students who work in the laboratory ),
student. The roles divide up succinctly what one can do in the web app - access to resources, ability to create/edit but not delete, sending emails, etc.
Currently I have a
director-level account that only I know the credentials for. However, it just so happens that recently I needed full access to the system to edit a particular resource which even
director didn't have full access to. I'll note here that there are some resources that
faculty users create that even
director can't modify, which just-so-happened to be the thing that needed to be modified.
So, I SSH'd into the server, ran
rails c to get into the database, and manually changed the resource there. Needless to say, that was a time-consuming process that could have been much faster had I simply access to update the fields via the existing web form.
I could very easily create an
admin role to ensure that I always have full access to the system if need be. However, I graduate in a year. Though I'll be maintaining the project for years to come, it's not impossible that someone else takes over.
Currently, no user has full admin rights in the system; I have full access by SSH'ing into the server and accessing the database directly, but this isn't ideal in terms of data management as it's a cumbersome method. Thus, a full-access
admin account would be very useful. However, our use case only requires that an
admin edit data in extreme circumstances. Most of the time, roles such as
faculty create resources that even
director (more or less a pseudo-admin) shouldn't modify.
Should every software system have a full-access
admin user? Or, is there some more appropriate solution that I am overlooking?