We need to formalize a "root" account, which is created upon installation, cannot be deleted, and cannot be modified by anyone except the root user.
This should be implemented as a special user account, rather than a special permission group. Thus, only one account can be assigned "root" status.
The root user should have access to every page, no matter what their permission settings are.