That surprises me that an employee with no reason/need to see waitlists in advance would have it. I don't think an employee looking at yields for possible non-rev travel would have such a need. People on the waitlist are already confirmed on the flight, so they would know the loads without needing to know the waitlist and how customer names are ranked.

So much for the least privilege concept. But I know this is AA and their IT practices may not be in line with modern standards....