+1 Except that Eve, being a criminal mastermind, would have hacked in to Bob's account so he would have had to fire himself :-)

Shared accounts also makes it much harder to detect when a bad actor has gained access to an account they should have access to.

Added to body. I didn't add the part about account compromise because I think that applies to all accounts. If I'm misthinking that please let me know and I'll throw it in.

Even if Eve isn't out to sabotage the company, Alice and Eve's sharing an account also means that Bob can't give Alice additional permissions without also giving them to Eve. If Alice is promoted and now has access to data X, Eve gets it, too.

@Adonalsium With regards to the account compromise, if I notice a file pop up in my personal directory, or pages in my browser history, or anything else out of sync with my account, since I'm the sole user that sets off a red flag. Even if I'm using a communally accessible directory, files I create have my owner id on them, and if things pop up under my name, I'd react. But on some of our test machines, there are some test accounts with shared login information, so when things pop up, I assume someone else with a valid reason created them, not suspecting that someone's compromised the account.

The specific term for the desired state is non-repudiation - the ability to (with a high level of confidence) associate actions or changes with a unique individual.

"If Alice and Eve had separate accounts, Bob could be sure that Eve was the one who did the sabotage." Assuming Eve was not able to obtain unauthorized access, of course. If Alice has her passwords sticky noted to her monitor, you might have problems.

@jpmc26 This is true, but this is not specific to shared vs non-shared accounts.

It seems a much of this is mostly about sharing account passwords rather than merely allowing access through another account? You don't have to disable other people's accounts if their passwords weren't shared.

In this example, Eve might be malicious or more likely clumsy. Who dropped the OrderEntry table? WTF guys?!

So, this is less of a theoretical principle and more a practical reality type thing, but it's also a lot harder to manage securely storing and sharing the credentials. If the password gets shared, the number of times in it's lifespan it gets sent through some channel increases, and so do the chances that someone will use an inappropriate and insecure channel to do so.

"you will miss accounts": A while back I found out I had admin access (CRUD on all members, when I should only have been able to read my own records) to a 100 person org for two years after I left the company (that's when I discovered the mistake) and it was only removed after I informed them they hadn't revoked my credentials...

One reason is to not fail existing security related standards which REQUIRE the use of uniquely identifiable user accounts and minimizing or mitigating use of shared accounts. Example: PCI DSS for credit card processing.