A DSL for access control hides the risky part, nobody audits it until someone pokes a hole and prod becomes the test env.