Security only reviews the benefits-eligibility product in a final audit after development is “feature complete,” often rejecting work that citizens were about to use. What should the Product Owner do in the org-design conversation?

Critical cross-functional skills such as security belong in the Scrum Team’s ability to produce a Done Increment. Late external audits recreate phase gates, delay Time-to-Market, and turn quality into a surprise. Integrating skills or close collaboration so security work is in-Sprint is an organizational design choice that serves product value. Making security a second Product Owner or parking it after Done merely relocates the gate.