You can make it so employees don’t have ambient access to data, and require multi-party approval for all actions that require user data. Giving away a user pass

You can make it so employees don’t have ambient access to data, and require multi-party approval for all actions that require user data. Giving away a user password should be treated as a routine risk. I’m not saying that’s how it actually works, and this process doesn’t have warts, but the ideal of individual employees not having direct access is not novel.