> And if you're bad, which is also not uncommon, you just give it the broadest permissions possible and call it a day. Whether this is "bad" depends on what yo

> And if you're bad, which is also not uncommon, you just give it the broadest permissions possible and call it a day. Whether this is "bad" depends on what you're targeting... it's bad for security, but good for getting things done. And from an economic standpoint, right now, unfortunately the "good" approach is often the "bad" one. The $80M file may be less than the cost of doing it right. And until that changes, "good" managers will incentivize the bad approach.