> There are two schools of thought: 1) Security has to be enforced by code 2) Your employees are reasonable, and won't try to maliciously bypass security contr

> There are two schools of thought: 1) Security has to be enforced by code 2) Your employees are reasonable, and won't try to maliciously bypass security controls Huh? These aren't competing ideas. They're orthogonal, and should be covered by separate, complementary forms of security assurance.