Two thoughts: this wasn't a design decision on my part, it was already there. Second, based on feedback from my HP, is cloud providers AND application developers. My suspicion is that this sort of approach resonates with app devs. With that said, I'm OK with yanking this if you guys think it isn't worth it for the first pass thru here. I'm not even sure how much of this Identity admin stuff is even used, based on feedback from folks on my end. I was actually advised to just implement auth and leave the rest alone; my sensibilities wouldn't let me stop there...