Password reveals and record views are already in the activity logs, but reviewing them is entirely after the fact.
Let admins set a threshold on read activity -- X reveals or X record views by one user in a given window -- and get notified when it's crossed. Threshold and recipient configurable, since normal read volume varies a lot by team.
Two cases: an employee pulling client data on their way out, and a compromised endpoint where an attacker or automated agent drives an already-authenticated browser session through client passwords and asset pages. API and MCP restrictions don't help with the second -- it's an ordinary signed-in user in a normal browser.
The evidence is already logged. The gap is that nobody finds out until they go looking.