My read is that the issue is that the employees were approved to run the SSH daemon as a client. The people approved were being approved to view/access data tha

My read is that the issue is that the employees were approved to run the SSH daemon as a client. The people approved were being approved to view/access data that perhaps they have no need to, nor the vetting or experience to know what data they're dealing with. Which is a valid concern. The people approving access and the people with access should have clear knowledge, experience and intent on how they will use the tool and for what purpose.