Picture this. It’s 2 a.m., production is hurting, and an on‑call engineer needs temporary access to a sensitive AWS environment. The incident channel lights up, someone drops the Teleport link, approvals bounce between threads, and five minutes later you still do not know who actually touched what.