[leokennis]

Solution would then be to ask for and log the reason for the access. Possibly with an approval needed by a second person. You can still lie about why you need access, but at least it is logged then.

[jasonfarnon]

I'm sure they do this--but the rogue employee still gets access and OP was saying access should be prevented in the first instance.

[loeg]

Meta does this.