Hacker News Reader

Hell, you should offer an internal bounty to any employee who reports “I got access to something I shouldn’t need”.

Part of what I do first at any new employer is ask myself the question, "if I wanted to burn all of this to the ground, how would I do it?" I generally don't share the fact that I'm going through this little thought experiment with my management, but it helps triage what's currently "broken", and gives me a clearer focus on what needs to be fixed.

If I'm thinking about it, I can be assured that someone with differing motivations likely already has, or soon will be thinking about the same.

This approach is possible but increases the complexity of your problem by enormous amounts. I know of only a very tiny number of companies that have an active goal of preventing rogue insider threats in a serious way. And the solutions do meaningfully inhibit developer productivity.