I don't think it is possible to do it the simple way and reliably deploy for millions of users. Plus there is administrative burden. How do you audit this stuff

I don't think it is possible to do it the simple way and reliably deploy for millions of users. Plus there is administrative burden. How do you audit this stuff? How do you ensure compliance for an endless set of rules and regulations? This ain't someone's side project. While developers might be inclined to side with the simple approach, too many other departments in the company may push back.