#attack surface reduction · 1

Decide the Tier, Not the Exception

Hardening stalls when it's one setting for everyone. Tier it by user group, start from a benchmark, and decide the trade-offs once per group instead of once per request.