Limits of Kali's non-root default user when credentials expire or tools demand root

Since the 2020.1 release, Kali Linux installs with a non-root default user that gains administrative rights through sudo, and direct root login over SSH is disabled in the shipped OpenSSH configuration. I am planning a lab deployment built around this least-privilege model and want to understand its practical boundaries before committing to it.

My specific goal is to run the full desktop session and all penetration-testing tooling as the non-root user, relying on sudo and polkit for elevation, while enforcing password aging through the standard shadow suite (chage, /etc/shadow). The uncertainty is where this model breaks down: some workflows such as raw packet capture and certain wireless operations still need elevated privileges, and I am unsure whether sudo-per-command is sufficient or whether any documented tooling assumes a persistent root context.

A second concern is expired credentials. If the sudo-enabled account's password expires, login is denied until the password is changed, but I am unclear on the recovery path when that account is the only administrative user and root login is disabled.

Which Kali tools, if any, are documented to fail or behave differently under sudo rather than a real root shell? When the sole sudo user's password expires, what is the supported way to regain administrative access without re-enabling root login? Is re-enabling PermitRootLogin for automation ever considered acceptable within Kali's own guidance?