General question regarding brew installation in multi-user (admin / non-admin) systems

[renet10]

Output of brew config

HOMEBREW_VERSION: 5.0.4
ORIGIN: https://github.com/Homebrew/brew
HEAD: 138341781728c93d3886a9d680445d7996682e2a
Last commit: 2 days ago
Branch: stable
Core tap JSON: 03 Dec 05:18 UTC
Core cask tap JSON: 03 Dec 05:18 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_DOWNLOAD_CONCURRENCY: 24
HOMEBREW_FORBID_PACKAGES_FROM_PATHS: set
HOMEBREW_MAKE_JOBS: 12
HOMEBREW_NO_CLEANUP_FORMULAE: [email protected],[email protected],ffmpeg@7
Homebrew Ruby: 3.4.7 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.4.7/bin/ruby
CPU: dodeca-core 64-bit arm_blizzard_avalanche
Clang: 17.0.0 build 1700
Git: 2.50.1 => /Applications/Xcode.app/Contents/Developer/usr/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 26.1-arm64
CLT: 26.1.0.0.1.1761104275
Xcode: 26.1.1
Metal Toolchain: N/A
Rosetta 2: false

Output of brew doctor

Your system is ready to brew.

Description of issue

I have been using brew for many years but only recently did I find out brew was not recommended for multi-user systems.

At the risk of kicking off a firestorm, I'd like to ask a general question of what problems brew experts see in a system where:

• brew is installed and maintained only by the admin account (as mentioned in Does brew support using a non-admin account? #4149)
• but non-admin users may use the formula and casks

It seems brew works quite well already in this manner where only ONE user (the admin user) can issue brew commands but everyone else can use the software brew installs. I have been ignorantly operating like this for years, without needing to chown anything (well, I did run into an fpath issue, but ...)

The reason for bringing this question up is as follows:

1. Brew installs into common directories such as /Applications, /opt, /usr/local, etc. On this surface this appears to follow the OS X Installer "Install for all users" method as opposed to "Install for only this user" (which installs into the user's home directory), and is a cause for confusion.
2. Sub-point of (1), brew does not behave line single user environment managers such as conda / venv / etc., which isolate all software into a directory. I understand of course that env mgrs are for different purposes, but the point is if you want something isolated, it should not be put into common areas.
3. General OS X best practices recommend admin / non-admin separation, where installation is handled by an account with elevated privileges; whether this is a valid best practice or not, thousands of users operate in this manner.

What I'm hoping to understand is whether there are security issues, LaunchAgent issues, fpath issues, etc., that are known if brew is installed in this manner, and whether perhaps formulae / cask construction guidelines instead of code changes can be created to bypass such issues.

Thanks!