An audit finds 40 engineers with permanent production database read access. The team says they need it for support. Resolve it.

What the interviewer is testing

Whether you can remove standing access without removing the capability the team genuinely needs.

Why standing access is the problem

Forty accounts with permanent access to production data means forty phishing targets, forty credentials in forty password managers and browsers, and any one compromise is a full data extraction. It also means every access looks identical to every other, so misuse is indistinguishable from support work.

The team's need is real. The standing nature of the access is what is not.

The resolution

Establish what they actually do with it. Query the audit logs. Typically the large majority of queries are a handful of recurring patterns — check an order's status, look up a customer's configuration, verify a transaction. Those do not need database access.

Build the tooling for the recurring cases. A support interface exposing the specific lookups, with the results scoped, personal data masked by default, and every access logged against a ticket. That removes most of the demand entirely and gives better audit evidence than raw SQL ever did.

Just-in-time elevation for the remainder. Genuine investigation needs get access on request, granted in seconds, time-bounded to an hour, tied to an incident or ticket reference, announced to a channel, session-logged, and automatically revoked.

Break-glass for the emergency case, with a path that does not depend on the system that may be down, notify-and-review rather than approve-before-grant, and a review that actually happens.

What makes it acceptable to the team

Speed. If elevation takes thirty seconds and is never refused, the objection dissolves. If it requires an approval that takes twenty minutes at 3 AM, it will be circumvented and the standing access will quietly return.

What a strong answer adds

The metric that shows it working: elevation requests trending down over time as the tooling absorbs the recurring cases. And a framing that helps adoption — an engineer with no standing access cannot be blamed for an incident they could not have caused, and is not worth phishing.

Common weak answers

Removing access and telling the team to raise tickets. Reducing 40 to 15 without changing the model.