[jasonfarnon]

I'm sure they do this--but the rogue employee still gets access and OP was saying access should be prevented in the first instance.