Hm.. I've done many bad things as root.
I once wrote a script that was supposed to (among other things) periodically clean a directory called
/foo. So the script was executing as root and did something like this:
rm -rf *
One day the
/foo directory didn't exist because of some problems with our SAN. Result: catastrophe.
Now this is of course just a badly written script; it should have been:
cd /foo && rm -rf *
but it shows you how easy it is to do something seriously bad if you have too much privilege.
The other problem you have when everybody logs in as root is as that you loose the whole traceability/auditability thing. Who knows who has done what? Is that really acceptable?
The question to ask yourself (and your employer) is: what is that you need to do that
requires you to be root?
On this particular topic I really prefer Solaris over Linux. (please don't flame, I'm only talking about the topic of the root user). Even if you are not on Solaris I believe there things to be learned from how Solaris does it. You may be able to mimic some of this on Linux.
Solaris (later versions) doesn't by default let you login from outside as root at all. Indeed root has become a role rather than a regular user. If you have the sufficient privilege and know the root password then you can of course login to root, but only after having logged into the host as yourself first and then su into root. This way you can always see who has used the root account.
Furthermore you have the whole fine grained privs setup on Solaris, for example you can assign the privilege to bind to a socket <1024 to a particular service. On Linux such a process must be started by root. Secondly you have RBAC and delegation of SMF privileges (the right to start, stop or administer a given service). With this there's rarely a need for anything really to done as root.
Solaris really - by the way it is configured out-of-the-box as well as the features it offers - discourages you from using root and makes it easy never to use root account. I hope one day to see the same advances in Linux.
Your boss' counter-argument to all of this is that it will take time to define and configure. This is true but your site seems pretty big. So the key word is standardization. Define those roles once and for all by utilizing the features that your OS brings you. Then standardize across all your servers. The other keyword I would like to bring to the table is principle of least privilege. You should never have more privilege than your job requires. Unfortunately you are at the mercy of how fine grained your OS's privilege model and delegation model is but read up on it and you will likely see that your OS has done great advances in this area in the past 10-15 years so there's perhaps no longer a need for you to login as root?
Apache httpd shouldn't run as root. Period! If your webserver gets hacked then the intruder suddenly has root privilege. Your OS may force you to start it as root but apache httpd has a feature for immediately switching to another user. Look into
Group settings in the config file for Apache httpd.