It could be interesting to map the local root user to a non-privileged storage UID (so similar to admin=0 with an idmap rule), but also treat it as a special case from every other 'standard' local UID, so that this local root user can be granted some subset of the 'root' user capabilities.