How do you handle a situation where a client requests a feature or system change that goes against technical best practices or security standards?