Liability transfer agreements?

I'm coming closer and closer to a situation where I believe I'm going to be directed to grant some users access well beyond what is appropriate for their role within the system because there's a small piece of data that they may need to modify once a year that requires opening up full administrative access within this system to edit.

​

If/When this directive comes down, I would like to make it as clear and documented as possible that I'm being directed to do something that is considered bad practice and is against my professional advice. I'm wondering how other organizations handle such a situation. Do you actually have an agreement that is printed out and signed by the party assuming liability for this situation? Do you just send an email detailing this and accept them replying with an affirmative as documented enough? Just do what you're told and hope nothing goes wrong and you don't get audited by anyone who cares?