SQL Process is not enough friendly. because user still remember sql command.
I think about "Report & Process" or anything can run a sql.
Make new class AdminProcess extends SvrProcess
parameter is type.

when type = Reset "Access Advanced: just do sql command to reset for only System Use
after we can add more type.

Hiep - do you mean http://wiki.idempiere.org/en/SQL_Process_(Form_ID-111) ?

I see it same a case in window.
when admin remove all user in security tab of a folder. nobody can access, change properties, set right in this folder. it's suitable.
we see “Access Advanced” field as a "Advanced" field. because when admin remove right “Access Advanced”, he can't see this field. it's also suitable.

I also run sql is not friendly with user.
same window, admin can re get right access folder by run a process get owner.
I think we can make new process to run sql, default only system admin role can run this process.

I'm sorry that you disliked my proposed solution. Anyways the great about iDempiere is that is so configurable that enables you to set up your implementation as you prefer and same for all users with other different needs.
Thanks for your valuable opinion based on your vast experience. It led to a migration note that was missing, and I'm sure other users will find your configuration advice here worthy too.

I rest my case – still think this is a plain stupid user experience and that is based on my +15 year’s experience of implementing and developing ERP systems!

/Flemming