The trick is to have good access controls so confirmations happen often enough to be useful, but not so often to be rubber-stamped

I guess most of the common task are scripted / automated. Running a "raw" sudo command should be very very rare.