We have a CI tool that I've been trying to secure for a long time. Usually when I add something (SSL so people can't sniff passwords / hijack sessions) the resp

We have a CI tool that I've been trying to secure for a long time. Usually when I add something (SSL so people can't sniff passwords / hijack sessions) the response I get from some others is "why bother? If something bad happens the person who does it will be fired!" It baffles me really. Most of the time I do it anyway. But we still have a few major holes I've been slowly patching. There's one last glaring problem: permissions are controlled by teams in an external tool. Anyone has auth to change teams in said tool.