You can't completely control what you allow, and you allow users to have access. A level of trust is inherent when you grant access. There are steps you can take that will make it much more difficult for an internal user to cause damage, lessen the amount of damage they can cause, and increase the likelihood that you can recover from what damage does occur. Doing so requires a comprehensive Process of Security. Security is not a product, nor is it a technology.
Security is a process.
The Process of Security consists of many things including policy, procedure, and training. It contains preventative control measures and a healthy dose of awareness. It includes disaster recovery and business continuity. Various products and technologies support all of these elements of the process. Primarily, this is true because of the most fundamental issues a Process of Security must address in order to stem the internal threat - those of human nature and trust.