Master Account

It may not be obvious that there is a user level with more access than Admin (although it works in conjunction with Admin). That level is called "Master Account" and it cannot be set from the dashboard. User #1 is given Master Account status by default, but if you add other admins, they are not given this permission automatically and you should be careful with giving this extra permission.

So what is Master Account?
Master Account is reserved for things that could impact the security of your site or cause other types of abuse. These include (but aren't limited to) installing plugins, themes, widgets, filling out bug reports, and doing backups (which would allow someone to fully download your source code and database). Some plugins (such as the database and file manager) are also master account only.

How do I give someone a Master Account?
Simple. Go to users/init.php and add their user id to the $master_account array.

Why is it done this way?
There is a concept in hacking called "escalation of privilege." The idea is that you can chain a whole bunch of hacks together to gain additional permissions to perform bigger and bigger hacks. While there has never been a demonstrated case of someone being able to promote themselves from "User" to "Admin" in UserSpice, we have taken the stand for years that we wanted to protect your project's most valuable secrets in case it ever happened. This is primarily your source code and direct access to the database. This is why you must physically change the init.php file to escalate someone to Master Account. The idea is that if someone has the ability to edit your init.php file, it is game over from a security perspective anyway.

Debugging
A quick way to know that you're an admin without Master Account is that you click something in the back end and find yourself redirected to the dashboard.