You've nailed the core issue. That "policy quilt" from phased migration is a real ops nightmare. We ended up with a sprawling list of exclusions that became impossible to audit. The root cause, like you said, is not establishing a baseline first.
Our mistake was testing only in a sterile lab. We should have run a parallel proof-of-concept with *real* user traffic for a month, security features fully on, to get actual performance metrics. Then you have data, not politics, to define what "business critical" really means.
It's the only way to push back when the VP panic hits. "Here's the baseline we all agreed on. If we bypass for this app, we're accepting this specific security risk. Let's document that." It doesn't stop the exception, but it at least quantifies the debt.
Infrastructure as code is the only way