I continue to advocate for something like this or removing admin’s ability to view PMs and impersonate. Possibly as a site setting at install… there are so many discourse communities which are not typical message boards. So many of us who don’t need/want the admin role to me the eyes that can see all info as some of us use it for sensitive info and in business groups.
There’s been a constant push back from the devs and others here always justifying why admins should have the current access levels to manage a community, but rarely do they actually listen to the fact that there are admins of communities literally asking to either heavily restrict and log any of that activity or remove the functionality.
I think it would be useful to have an at install/initial setup, disabling impersonate and DM access… with an all admin/moderator required input to approve a global setting change to enable it on a live community with a disabled install.
Call it a max privacy vs standard community installation.
There are too many use cases and applications at this point for discourse communities not to think about this kind of stuff..