Witnessing in this way runs counter to my experience of system management. How can you see (in real time) a query, the encryption, the email and the log deletio

Witnessing in this way runs counter to my experience of system management. How can you see (in real time) a query, the encryption, the email and the log deletion? I have run sql monitors and I see queries appear and then disappear... but my brain doesn't allow me to understand what the user is "up to" without lots of investigation and so on.