Systems are designed for people. Consider how people will use security features.
That’s the sort of thing we were trained to do. Instinctively look for something that had gone wrong or someone who had done something silly and torn up the rule book.