Spec author here - I appreciate the points that a perfect solution may not be possible. Perhaps I'm a delusional optimist, but I still think it's worthwhile to

Spec author here - I appreciate the points that a perfect solution may not be possible. Perhaps I'm a delusional optimist, but I still think it's worthwhile to draft a spec despite this. The security landscape has a similar problem. If I want to buy a SaaS tool from you, it's prudent to check if you have good security practices before I buy. But how can I know if you are secure? What does it even mean to be secure? ISO 27001 certification attempts to address this. To get certified, you present documentation about your management practices to an independent auditor and if you can prove you implement the required controls, you get the certificate. Then when I ask you if you are secure, you can present me with your ISO 27k1 cert. It can be gamed, and it's not a guarantee that my data will be free from breaches, but it gives enough assurances that the distinction is still useful. If the security folks can have nice toys why can't we AI people? :)