@dtanzer @Tesla You
could have the same with SSH, where employees can only log in via an SSH gateway
that logs all activities.