Reminds me of some government work I've done. The worst case was when I wrote a best-practices manual for Java/database/security for their internal development

Reminds me of some government work I've done. The worst case was when I wrote a best-practices manual for Java/database/security for their internal development, and it was basically taken in draft form, put in a big 3-ring binder, and put on a shelf to never be read by anyone. They paid a solid 5-figures for it, but more than anything it was a checklist item that could be signed-off in order to appease the auditors. "Yes, we did the required review and policy and procedure development".