Two-tier security around access control for privileged credentials