Regulated software, with the constraints that implies
Configuration that would weaken a control refuses to boot. Sensitive actions need a second person. Evidence is append-only. These are not obstacles to route around — they are the product, and work here means designing within them rather than shipping past them.