It seems to me like you basically need a programmer who has experience doing the actual job to specify what's needed. I've seen things get morphed from what th

It seems to me like you basically need a programmer who has experience doing the actual job to specify what's needed. I've seen things get morphed from what the users need to what management wants and end up badly misaligned. You're also right that there's a gulf between what users ask for and what can be sensibly implemented due to security, etc. considerations. E.G. wanting SSL to just work and ignore all cert changes magically just isn't ever going to be secure.