Object security on IBM i

Many installations run on users who hold *ALLOBJ because "otherwise it does not work". How you end up there, and how to get out without stopping anybody's work.