I have a box I am dedicating to Debian developer access. I am currently 
looking for ideas on how to make the system a little more secure for 
those developers that need root access. Of course, building a zone is 
the first thing that comes to mind but I'm thinking that it's not hard 
to automate building of lightweight zones such that we could have a zone 
per developer. The process might go something like:

% ssh dev_name@testbox
dev_name@testbox % need_zone
root@dev_name # ...
dev_name@testbox % release_zone

Where need_zone is a SUID script that looks something like:
---
if [ zone does not exist ]
    build/install zone from a cloned filesystem
    echo $InternalIP $ZoneName >> /etc/hosts
    cp ~/.ssh/authorized_keys /$ZoneRoot/root/.ssh/
    zfs snapshot $ZoneFS@installed
fi

if [ zone not running ]
    boot zone
fi

ssh root@$ZoneName
---

and release_zone is something like:
---
if [zone is running ]
    halt zone
fi

rollback zone filesystem to installed state
---

This provides a developer with root access to a Nexenta instance that 
can be easily cleaned up and will prevent developers from stepping on 
each others toes.