You grant SSH access in production, blink twice, and someone has just catapulted half your logs into a personal bucket. It is not malicious every time, but it is always messy. The fix starts before anyone even touches a session, with the ability to prevent data exfiltration and generate SIEM‑