Picture this. It’s midnight, a service flares up in production, and you log into the cluster to fix it fast. You open a session, run a few kubectl commands, maybe tail some logs. Hours later, the audit trail looks like static. It’s clear someone had command access, but