@polotek @tillshadeisgone As I've said to you elsewhere, I agree this one guy isn't the only problem and my preferred answer to this is delegated authorisation as used by LTIs and the like. Putting pressure on bad actors is the tool at my disposal so I'm doing that. So far it's working, but as I said above it's not my preferred solution.
@sbszine @tillshadeisgone "so far it's working". I think this is the specific part that I disagree with. And I keep asking why people think it's sufficient.
But I get it. That's all people feel empowered to do. So we're gonna just wait around until the bad thing happens. And then be mad about that to anybody who will listen. Being mad in public is the security blanket. I think we understand each other better. Thanks for hanging in there.