PAM

Privileged access management hands out powerful access for the moment it is needed rather than leaving it permanently attached to somebody's account.

You ask, the system checks, it issues access for a window and takes it back afterwards, recording what happened. The effect is that an attacker who steals an account usually steals an ordinary one, because the powerful rights were not sitting there waiting. It also produces the first honest picture most organisations get of how often those rights were genuinely being used.