By examining the transaction of concern (and perhaps some of those around it) it could still be possible to determine if it is a process or a person, even if everyone/thing logs in as SA.