root tool acting on behalf of a user - what to set and how