Comment by oneplane

Since SIP, it's MDM with DDM and you can basically leave engineers be local admins as it has no impact on the system state anymore.