I've been tasked with assessing the security risk involved with allowing a third party vendor to debug their queries remotely within SSMS. This means that the user's account must be in the sysadmin fixed role. While this means that the user for all intents and purposes "owns" the SQL Server instance, we have set that instance to a service account specific to that vendor. I'm left with primarily assessing the damage that can be done using xp_cmdshell.
I know that a sysadmin can undo almost anything that is implemented to monitor that activity, but if there is a way to monitor it (using Extended Events perhaps?) and/or log function use it would provide us with an additional level of security.