It doesn't need root access, the RBAC is applied on top of the credentials Aidmin given.

I hear you on the approach, it is something I have been thinking about for a while.