I'd say secure systems need to be based on the assumption of insecure humans. Nothing is absolute in security but we definitely should start the analysis expect

I'd say secure systems need to be based on the assumption of insecure humans. Nothing is absolute in security but we definitely should start the analysis expecting people to behave incorrectly and insecurely. This is not a new problem: https://en.wikipedia.org/wiki/Byzantine_fault_tolerance https://en.wikipedia.org/wiki/Byzantine_fault_tolerance