Architecture perspective
Security should be visible in the architecture
Trust boundaries belong in the system model, not in a hidden list of controls added after the design is finished.
Where does trust change hands, and can the architecture show it before an incident does?
Trust boundary
Model the boundary before choosing the control.A secure product should make permissions, data movement, authority changes and failure modes deliberate enough for engineers and operators to inspect.