What's the "Instant PIP" condition for the Sec Team? As a counterpoint I would suggest they run the Credentials Server themselves with ironclad SLAs and massive

What's the "Instant PIP" condition for the Sec Team? As a counterpoint I would suggest they run the Credentials Server themselves with ironclad SLAs and massive penalties on an SLA breach.