Why not let the administrator decide?

Why not let the administrator decide?

A problem is that most policies still have not changed (including the one from my country).

And even in places where the official recommendation has changed, a lot of the organizational policies haven't caught up. My USA-based employer is still requiring password rotation even though our government now says it's a bad idea. We all know it takes a long time for best practices to move from the bleeding edge to common use, so it's no surprise that best security practices are the same way. Using technology to force those best practices is an interesting approach.