It happens at 2 a.m. A production alert fires, an engineer jumps into an SSH session, and muscle memory takes over. Minutes later, the problem is fixed—but so is a new compliance headache. Sensitive data scrolled across the terminal, every command had root context, and the audit log