often we're told to add Google XSS-as-a-serv.. I mean Tag Manager, then the non-tech people in Marketing go ham without a care in the world beyond their metrics. Can't blame them, it's what they're measured on.
Marketing and managers should be restricted as well, because managers set the priorities.