I let people set their own password. This is like canary letter for them to know if anyone accessed their data. If sysadmins need access they take it and go thr

I let people set their own password. This is like canary letter for them to know if anyone accessed their data. If sysadmins need access they take it and go through a new password rotine with the user. I also have no password requirements (other than non-blank) I do this because I see it as user centric. I have never had a problem. One environment requires no privacy expectation. That environment we use simple nouns all in the same category. All the environments are full SSO they only need to login.