We have a requirement from a client to protect the database our application uses, even from their local administrators (Auditors just gave them that requirement).
In the
I think the right solution would be to only allow trusted people be DBA's. It is implicit in being DBA, that you have full access, so in my opinion, your auditor should demand that you have procedures for restricting who has DBA access. That way you work with the system through processes in stead of working aginst the system (ie. sql server). To have person you don't trust be DBA would be nuts...