How do you balance the need for strict security controls with a development team's need for rapid deployment?