So I'm in the process of working on part of our new role based site security system and have come up to the "nuclear missile" condition.
The system is based around the idea of grouping, with the ability for users to be implied to be in groups based on current groups, like so:
Tom is a master Cake Maker
by putting him in the Cake Maker group, it also implies that he is in the baker group, thus he doesn't need to be physically put in that group.
By implication of being in the baker group, he could be put into any other baking sub group.
If tom became CEO of his bakery, he would be taken out of the baking group and be put in the CEO group, which then implies he has access to all groups (baking, cake making, etc).
The "nuclear missile" condition is thus: I am a web developer, thus i need to have access to all groups so i can test for various conditions and bugs that may occur during the lifecycle. But there also might be sensitive data that I shouldn't be looking at, this might belong to the HR group or the Finance group. By implementing the nuclear missile system it would mean for me to get access to the live pages, someone from the HR group or Finance group would have to provide their password at the same time as mine.. 2 password fields on a page.
This is quite a fun solution, but i'm not convinced altogether practical. How do you generally protect rogue system developers against sensitive data? do you hash anything sensitive and only reveal if the person is actually a member of the group that belongs to the data.
do you even care?