Embed security at the architect level, rather than adding controls later