I usually (in sandbox environments) let the base user have full sudo