I've personally come to assume that everything I do on an electronic device is being recorded all the time, so the mere presence of surveillance isn't in itself

I've personally come to assume that everything I do on an electronic device is being recorded all the time, so the mere presence of surveillance isn't in itself a deterrent. Most reasonable people will IMHO realize that no one's going to read through the interminable logs of SSH sessions, 99.999% of which will likely turn out to be most mundane and boring. Apart from that, storing and securing these logs will in itself become a liability. Imagine all the sensitive information that might get caught in those logs, only to be leaked itself in a titanic stroke of irony! Relying on surveillance is folly; simply lock down access and remove privileges that aren't necessary. This is something you do once and never have to think about again, unless some event warrants a review. Thankfully such reviews can be triggered by normal business activity: new project, new employee, new team, new vendor product, etc.