Comment by eddieroger

> restrictions we on the outside have to suffer

We can disable SIP with a reboot to recovery and a single command. That doesn't seem like too high a bridge to cross and probably as good as any internal tool, if that isn't what they get in the first place.