Instead of protecting the castle, protect the user