Forum OpenACS Q&A: Re: RFC: Security policy for OpenACS (Security hole in OpenACS 5.1!)

I think your would want both. Sudo on Unix is pretty flexible and doesn't really get in the way. I don't even have a root account on my mac but sudo bash works just fine and I think you would want something similar for the web.