Yeah, and I'm sure there are solutions smarter than I can imagine, where all user-generated data gets consumed through a pipe and it's just a matter of having g

Yeah, and I'm sure there are solutions smarter than I can imagine, where all user-generated data gets consumed through a pipe and it's just a matter of having guards that look at the combination of user data type and user location and filter it out. But it feels to me like there are still going to be a million little branching problems at places beyond the pipe.