Why CRM security is always a 'role'-your-own project