Great explanation. Aside from using standard tools, that's the best benefit I've ever seen for your business. I rank it as best since my specialty in INFOSEC is high-strength attackers and subversion (eg malicious admins). There's rarely 3rd-party services designed to technologically counter the latter. Your solution is straight-forward, too.

One concern I have is right here:

"your (vetted, verified) request."

What's that mean specifically? There's potential for attacks there. For instance, a request from several email addresses might come from computers the admin controls. Same with some 2FA's. One would have to be careful here. I got a voice idea that just passed through my head that could leverage their smart (or dumb) phones. Also maybe dedicated tokens, apps on their phone or home computer, or something that come from your company. I'm curious what you're already doing, though.