I let people set their own password. This is like canary letter for them to know if anyone accessed their data. If sysadmins need access they take it and go through a new password rotine with the user.

I also have no password requirements (other than non-blank)

I do this because I see it as user centric. I have never had a problem.

One environment requires no privacy expectation. That environment we use simple nouns all in the same category.

All the environments are full SSO they only need to login.