This is seen in the infrastructure side at any non-startup company. Let me give you an example of ACLs management. 1. First they get devices from one vendor. T

This is seen in the infrastructure side at any non-startup company. Let me give you an example of ACLs management. 1. First they get devices from one vendor. They set up ACLs in certain way: hardcoded IP addreses/ranges, hardcoded ports. 2. Then come devices from another vendor. This addes another layer. 3. Another vendor comes with an acl automation tool and tells team to create objects/references for ip addresses/ranges/ports. Some guys follow it; some thers don't. 4. You can see a big mess of things created by many vendors, many software automation tools, manual additions, etc. One day, some guy changes the object/reference; all of sudden, production outage: add another layer of manual edits on the top. That's why they preach "if it aint broke, dont fix it, but add another layer on top of it".