When access decisions are made without enough attention to operating context, the result is usually either over-permissioning or a growing pile of custom exceptions. Both outcomes add maintenance cost and reduce trust in the model.
A better approach treats security design as part of how the organization chooses to structure responsibility. That means understanding not just system capabilities, but reporting lines, process ownership, and the situations where real work crosses formal boundaries.
The goal is not to create perfect purity. It is to create an access model that people can understand, operate, and defend over time. That requires technical design and organizational design working together.
Security becomes more durable when it is shaped around real responsibilities instead of isolated configuration decisions.