I spent forever stressing about security and privacy for my (now defunct) async standup tool.

It was a whole, big thing. You had a workspace with various roles and then a team where you were either a manager or a contributor. Later I got on this whole user management and access trip where there were user groups, and policy attachments, and permission grants. Then there was the default visibility settings…

It was way too complicated and you needed a flowchart to figure it out. Not only that, it had unintended behavior like losing access to your own standup posts after changing teams.

But why was it secret? It followed the standard pattern of

1. What did you do?
2. What are you doing next?
3. Do you have any blockers?

It’s not like it was sensitive medical data or top-secret war plans. It was “I worked on the API”. There was absolutely no reason it needed to be secret. It was stupidly overengineered. And who asked for this? No one. I just thought I needed it.

When I implemented users for Destato’s blockers, I took the approach of just leaving everything open. You can create blockers for other people, you can close them, you can do the same thing as everyone else. Not only was this much easier to implement (saved effort) it also made it a lot more usable. Now other users can make edits about things they know. You avoid gatekeeping and needing to ask a specific person to make the changes.

The simplicity can save you effort, but also improve usability.

“Only build what you need” feels like a lesson I keep getting more and more strict about over time.