Let developers bypass secure design because testing will catch every defect. This ignores a core requirement of the objective.

Accept third-party components without provenance, updates, or vulnerability review. This weakens audit evidence and creates operational fragility.

Wait until production release to run the first security review. This leaves avoidable risk for the scenario.

Integrate security requirements, threat modeling, secure design, verification, deployment controls, and supply chain evidence throughout the SDLC. Apply it to the identity program with documented validation.