Not everything should be on-prem, but some things should be. Access control comes to mind