- per session ssh keys that are valid for only 6 hours

- all ssh sessions are audit logged and have to go through jump servers tied to tech roles

- all sessions fully monitored via "script" and can be replayed

You can also see a write-up here: https://news.ycombinator.com/item?id=40840040