I think this sort of thing is a capabilities ladder in an arms race. If you never evolved account based security, you never built the infra for even evaluating

I think this sort of thing is a capabilities ladder in an arms race. If you never evolved account based security, you never built the infra for even evaluating application permissions in the first place.