I think that lesson is a great takeaway. I don't think it should have been possible to generate access levels equal to the user without their direct input (for

I think that lesson is a great takeaway. I don't think it should have been possible to generate access levels equal to the user without their direct input (for example, on a specific "generate access token" page). Then a satellite team requesting that ability hopefully would have raised red flags with the main team, if that's how they're operating.