Although, I'm giving him more credit than he is due. Jason posted this entry on his site. Go read it, I'll wait.
He makes a really good point about observing people's behavior rather than asking them. Most people don't want to believe reality about themselves. Women who want their wedding dresses to fit, users who act completely differently than they say they are going to. The essential key to software design is making the system adapt to the natural habits of users, because what they say and what they do is entirely different. The same goes for designing security systems. Observe the things that people do, regardless of what they think they do, and decide which actions they should be allowed to perform, then block everything else.