Note

Security controls should produce signal, not just friction

A control that only adds friction is hard to reason about in production. It may block something, annoy someone, or quietly move the attacker somewhere else.

The better version produces signal: which clients changed behaviour, which paths got quieter, which customer journeys suffered, and what the next safe adjustment should be.

That signal is what turns a security mechanism into an operable production control.