Picture a late-night production fix on a live AWS cluster. A senior engineer jumps into a session through Teleport, applies a quick change, and hopes nothing breaks. The session is logged, sure, but what happens inside that shell? Who ran which commands? Was sensitive data exposed? This is where audit-grade