Imagine a production incident late on a Friday. Someone has to SSH into a database node, troubleshoot a failing job, and promise not to touch the wrong schema. Access should be scoped, logged, and reversible, yet most teams still rely on session-based portals where once you’re in, you’re