I find it interesting that companies can convince auditors that security sidecars that add auth and encryption actually meet compliance requirements... it's a nice architecture but I'd argue it renders the environment non-compliant.