Coming at this from a different angle: I always found many security issues are actually data retention issues. The root cause is a system that is bleeding logs, context, and valuable traces; so, all of these safe guards like specialized access, elevated access, bespoke roles, etc. act not as remedies to the bleeding, but as tourniquets.
When data isn't being lost to the void, undo-ability grows. And, having perfect undo-ability is genuine "bulletproof" security. Security, in the traditional practice, then becomes needless undo prevention. That's a lot simpler to tackle than disaster averting prevention.
Very thoughtful post I feel that properly looks at local state and how to make it viable from a scalability standpoint. However, anyone else on train of local state = just bad?
The common argument against global state all the state is that some local state bookkeeping becomes too cumbersome, just like the article mentions hence the need for things like hooks. But, in practice I found paying the cost of build a global state render pipeline pays well in the long-term.
Typically, you only need to set it up once (and Clojure's data-oriented core makes that cost enjoyable even), and once you do get gain huge leverage for those cross-cutting UI/UX concerns (hide all modals when a fatal error occurs, check all form elements for validity before optimistically saving values, close all sidebars to make room for a payment modal, etc.)
When data isn't being lost to the void, undo-ability grows. And, having perfect undo-ability is genuine "bulletproof" security. Security, in the traditional practice, then becomes needless undo prevention. That's a lot simpler to tackle than disaster averting prevention.