How would you handle a situation where a developer disagrees with your security recommendation at Affirm?