I don't work in security anymore, but when I did, access tended to be... loose. Outside of security, there hasn't been a single job (of quite a few) where I did

I don't work in security anymore, but when I did, access tended to be... loose. Outside of security, there hasn't been a single job (of quite a few) where I didn't have root access. At one of the hosting companies I worked at -- for example -- I was able to download the root password of every linux host and the domain password for every windows host as a proof of concept for a project. Nobody told me to stop but as a courtesy I did end up telling the manager of the internal SOC that it was possible. He was pretty floored. Apparently they setup monitoring for single queries of passwords, but since my queries returned more than one result, it wasn't "caught". So yeah. Lots of access.