Picture this. It’s Friday night, you’re troubleshooting a production issue, and someone just demanded database access. You approve the session in Teleport, but an hour later compliance asks who touched the finance tables. The logs look nice, but they’re blobs of session data, not evidence you can