I have an admin account on the server and an SSO admin login for the services. Different credentials obviously - ones an SSH key and ones a password/passkey for SSO - but it seems to fit well. My regular account is bozo level and I don’t need to worry much, I just logout or go to a private window to do admin for an specific program, which is rare but easy enough when it’s needed.

So far for the SSO services with an admin account design, I just set it up so the admin account for the service is named the SSO admin account so it maps directly when I connect the SSO to it.

And I SSH into the server for admin there as needed.

And no mixing with my regular user account!