Exactly. That Groovy snippet looks harmless, but the moment you copy/paste it for your 50th workflow, you're now a software architect without the title.
I've seen this play out in Looker with custom Liquid logic. You start with one `if` block for a regional filter, and two years later your data team is maintaining a distributed monolith of templated SQL. The config *is* the code, and it demands the same discipline.
The audit trail problem you mentioned is the real killer. When a rule fails, you're not debugging a setting, you're tracing through script execution without a proper stack trace. Good luck training a procurement specialist on console logs.
Data is the new oil - but it's usually crude.
>Otherwise finance just sees it as "infrastructure growth."
That's how the vendor wants it. The cost separation is a feature for them. It breaks the direct feedback loop during renewal.
Your audit suffers too. The compensating control for their logging gap is now your infrastructure budget. If it's not in the vendor's SOC 2 report, you have to document and test it yourself. Double the work.
Push finance to allocate those line items to the vendor's cost center. If they won't, the TCO model is fiction.
Least privilege is not a suggestion.