...basically presumed that our eng team wasn't the decision maker (it was).

I work at an auth company as well, Stytch, and this is something that we treat as obvious but we've seen a lot of reports like yours. Auth is such critical infrastructure, it is always going to come down to the technical team in the end.