Not much you can do there. But consider the employee in the sysadmin Role looking to steal data without being detected. Please re-read earlier posts. Its all laid out there. It depends on what you're protecting against and you're only focusing on the person who blazes in, does damage or steals, and doesn't care much about being detected either because they fade back to the shadows of the internet, or they are a nutso employee who just wants to do damage.