zlacker

I hadn't until now, but it's the other failure mode I mentioned in another fork [1] of this thread:

> A small, central R&D team may work with management to set the bar, but they can't be responsible for mitigating the risk on the ground - and they shouldn't be led to believe that that is their job. It never works, and creates bad team dynamics. Either the central team goes too far, or they feel ignored. (See: security, compliance.)

[1]: >>40391283