A database administrator (DBA) should be prevented from:

To maintain the principle of segregation of duties and minimize the risk of fraud or misuse, a DBA, who has powerful administrative privileges over the database structure and system, should ideally not also have the ability to view or manipulate sensitive data content unless strictly necessary and monitored. Their role is typically to manage the database *system*, not its *contents*.

Preventing a DBA from having end-user responsibilities is also part of segregation of duties, but the direct access to sensitive data (A) poses a more immediate and critical risk to data confidentiality and integrity.

DBAs inherently need access to production database files (or the database system that manages them) to perform their administrative duties such as backups, performance tuning, and integrity checks.

An emergency user ID is a necessary control for all privileged roles, including DBAs, to ensure system access during critical outages when normal authentication methods fail.