TL;DR Link to heading My everyday macOS account isn’t an admin, and a separate local admin account is the only one that can use sudo. That keeps my login password from unlocking root, though a compromised everyday account can still work around it. Going through it tripped me up in a few ways: globs, ~ and $USER resolve as admin, and each command asks for the password twice. I gave admin passwordless sudo and wrapped su admin -c 'sudo …' in a zsh function called asudo, so I now type one password per command.