The database alert hits at 2 a.m. Someone ran an ad-hoc query that touched sensitive user data. You check the logs. The engineer had full session access, no fine-grained controls, and no real-time visibility. This, in short, is why least privilege enforcement and secure database access management are not