If no one is testing the rights we're supposed to have, then it's unclear that we actually have them. Auditing should seem eminently sensible to all the engineers here.