Washington's social services department just disclosed a breach of 8,600 people's records: names, dates of birth, Social Security numbers. No hacker, no ransomware. A staff member simply opened files they had no business reading. This is the breach your firewall can't stop. When a valid login can browse sensitive records and nobody catches it, you don't have an access control, you have an honour system. Least privilege and access logs aren't paperwork. They're the control.