I've been doing some auth development. Auth is hard because it's a deeply human problem, and therefore messy. Human beings share, cooperate cross-boundaries, se

I've been doing some auth development. Auth is hard because it's a deeply human problem, and therefore messy. Human beings share, cooperate cross-boundaries, self-organise and divide in all sorts of groups and hierarchies. There are policies and rules, and then there are unwritten rules and exceptions. On top of that, the planning phase of projects has lots of graphs and arrows of what needs to go where, but rarely includes the auth boundaries and permissions. It's an ungrateful job because basically you're throwing hurdles and setting limitations where everything would work by default in the utopia of an open internet (or intranet).