The Ping Identity Directory Server offers support for sensitive attributes, which can enforce strong protections for interactions with a specified set of attributes, including preventing even root users from accessing them. I wrote about sensitive attributes on my personal blog.