Your on-call engineer logs in at 2 a.m. to fix a broken deployment. They copy a command into the console, patch the issue, and log off. Hours later, compliance asks: who accessed production, what exactly ran, and which sensitive values were visible? Most tools give you session recordings and