Me too, and when I need to install non-Apple-approved software, I log into my admin account, do it, then log out of it again.

Once the software is installed, I can use it from my regular account.

> Staff do have local administrator access to their machines, but are not supposed to use it for regular operations for safety.

The point of this exercise is that installing random software from the Internet shouldn't be a regular operation; users should take extra care when doing it.

Just out of curiosity, why don't you just put in your admin credentials when the prompt displays? Logging completely out of the current account and logging in to another account just to install software seems way more convoluted than necessary.

That's what I do if it's an option, but I think I've run into some software where that didn't work and I had to actually log into my admin account to install it. (But not log out of my regular one; more than one account can be logged in at once.) I can't recall what software that was, though.

> I purposefully make my primary account a non-administrator and elevate permissions with my administrator account when I need to perform administrative tasks

So...elevate permissions when you need to perform this new administrative task? I don't see how that changes the crux of the matter (you still are the de facto admin, even though you've applied artificial constraints to yourself, because you hold the admin credentials).

Arbitrary programs cannot use de facto credentials.

...yes, they can? You're prompted to provide credentials (in some cases biometrics is fine, in others you must enter the password) if you/an application is trying to do something that requires escalated privileges.

Do you use macOS?

Right, but now you have explicit consent required to elevate to that level, whereas if you’re running as root already you can just silently do things without the user knowing.

> Do you use macOS?

Almost exclusively.

This is fairly standard best practice: your day-to-day account should not have admin-level privileges. It's the rough equivalent of running as root all the time (hand-waving a bit here).

Admin accounts on MacOS have to provide the admin password again (essentially sudo) to make any significant change to the system config. That includes installing applications, changing security, privacy and accessibility changes, etc.