[debarshri]

Combination of bash profiles and alias can be used to achieve this without installing any external thing. You can prevent commands like rm, chmod, cat etc even for root user. You can also prevent root users from accessing directories where the vault, database etc. Data is written.

Ps. At Adaptive (http://adaptive.live), we have kind of productized something like this.

[hk__2]

I don’t understand: you say one can do this without an external thing, and then promote your own external thing?

[debarshri]

It is not external things, but rather a centralized place to manage the policies.