Yep, a solution exists through. Here's how you get there: * Strong identity: employees must be strongly identified before acting. * Multi-party authz: nobody

Yep, a solution exists through. Here's how you get there: * Strong identity: employees must be strongly identified before acting. * Multi-party authz: nobody ever acts alone. One person can't be trusted, two people might be, M of N effectively represents the company. * Noisy security: making a change to security parameters notifies all relevant parties in a way that intentionally avoids notification fatigue. You can't sneak a change through. * Full auditability: even after the fact you can readily unravel what was done, seeing what the old state was, what was changed, who made the change, and who approved it. Get those points, and a few other minor details, and this larger problem actually becomes tractible.