sudo by email

Users with the right permission can email themselves a link with a token and clicking that adds a role to their session. This allows elevating yourself to admin when necessary but not being an admin all the time.