It fascinates me how some projects can be paralysed by legal and security requirements. Usually this happens when the (alleged) product owner doesn’t have the balls to challenge them, but is so scared of his own shadow that he blindly accepts anything legal or security wants – even if it literally means killing the product!