> How well do these techniques work in practice, particularly in a huge organisation? Like this: I log into system foo-bar-baz, which one person accesses once

> How well do these techniques work in practice, particularly in a huge organisation? Like this: I log into system foo-bar-baz, which one person accesses once or twice a year. Maybe it's christmas setup, maybe it's for daylight savings time, maybe it's for a new release of Ubuntu, whatever. I have all the relevant credentials, I am responsible for foo-bar-baz, and I have an authorised change request. Three days later, the security team sends me a slack message, asking if I accessed system foo-bar-baz. I tell them yes.