Picture this. Your production environment goes down at 2 a.m. The on-call engineer jumps in, opens an SSH session, runs a few fixes, and everything heals. But later, your auditor asks what exactly happened during that access. You have video logs of a terminal, but they are about as