If let's say 40 ppl can access a jump server routing to a Linux box, how would you know that of the 40 ppl only 2 ppl have root accounts? For audit and logging purposes, how do you test this?