It's not that hard to suggest access monitoring, isolate routine aggregate metrics and occasional needs, and have a process around other reasons why you'd need

It's not that hard to suggest access monitoring, isolate routine aggregate metrics and occasional needs, and have a process around other reasons why you'd need to run some more detailed analysis. You don't need the separation to be absolute on day 1, just known, discussed, and gradually limited to need-to-know.