Jump/Bastion servers everywhere, with the ability to "get work done" (via scp, and restricted SSH options) severely limited. That with VLANs lets' the PHB and 'Cyber insurance' people checkbox that "yes we are secure".
Everybody can `sudo su` with no restrictions and no additional password/2FA. Boxes on internal network can't access the internet (outgoing comms blocked). While this is handy during general usage, during setup for a 'TESTING' environment that might require 100 ruby/gems and 3rd party files to be installed, it's a royal pain in the ass.
I could easily breakout with SSH tunnels, but I'm trying to respect the client wishes. It makes the job 1000x unnecessarily difficult.
Penny wise and pound foolish.
So they give lip service.
OH, and all passwords are a variation on 123_$CORPNAME, $CORPNAME123, and abc$CORPNAME123.