Or worse, someone designed the database correctly, but then added a (hidden to the user) unique identifier that's normalized in some way to make it short, uniqu

Or worse, someone designed the database correctly, but then added a (hidden to the user) unique identifier that's normalized in some way to make it short, unique, and limited on allowed characters. Often /that/ doesn't get updated when they update the username, leading to mass confusing since external tooling will use that as the subject identifier instead of actually being given a proper internal identifier. (Offhand I can't recall if any particular standard happens to require that such an identifier start with a letter; at least one probably does.)