In a place where everything is monitored, down to the MAC address of machines and their network traffic, ideally it would be difficult to sneak in a monitor.

Access to critical data should be similarly protected.

These are relatively tame intrusion detection systems that you would have to make changes to in order to remain undetected. That should be really hard to hide.