The way I'd in principle want to solve this problem (controlling access to root-level resources that don't support delegation) would be with some kind of "escorted remote access" system, wherein an authorized set of people can remotely log into a special browser session that's able to act as the root user, but only with another authorized party watching and monitoring the session and able to kill it, so that no one c…
I've been thinking of a similar project but over SSH rather than a browser based thing.
Problem with that is that not everything is controllable over ssh. Sometimes you have to use a web interface provided by a vendor because that's the only thing they offer.