Ask HN: How to secure a database if employees are potential adversaries?

Many (most?) companies secure databases using some combination of password keys or limiting the db from being publicly accessible on the internet.

But if an engineer with credentials were to get phished, or were actively malicious, these methods aren't sufficient.

What's the best practice of hardening a database from internal attacks? Let's assume there are <5 people in the company who can be fully trusted.