and yet, "throw features at it until it meets the client's requested idealized spec, with weird carve-outs for some legacy system that we promise will be gone in a year or so, maybe" while also maybe conforming to some mythological security model drunkenly conceived by Baphomet" is where we arrive at in practice