System Administrator profile access: why admins can see all records regardless of OWD and sharing rules, and how to model a scenario where even admins should be restricted.