I think it might have to do with different teams in google having different views about how security on their different projects might have different needs.

- Letting each team have their own policy is a good idea because it allows the people who built it ; to protect it.

- The only people who notice are those who are over thinking it.

I too have frequently wondered why I can't adjust settings for such things. I also have wondered why I sometimes I have to re-login to groups when I go there, even tho I am currently using gmail in a different tab.

Even more than that tho, I would like to see a modern ident protocol, preferably one that is tied into a PKI and cryptographically secure. Then I wouldn't have to care about this.

I'm guessing because project teams are more independent than one might think. Perhaps they're of the mind that too much central management will stifle innovation?