
I Trusted My Own Safety Documentation. Then I Read the Test Suite.
My safety doc said a control was enforced at the tool layer. It was enforced by nothing, and a passing test in the same repository had contradicted the doc for 21 days. The documented-but-unenforced control as a defect class.