Effectiveness depends on adoption, not just design
Psychological acceptability holds that a security mechanism needs to be usable enough that the people subject to it actually go along with it, because a control people find genuinely burdensome tends not to stay effective for long — it gets bypassed, worked around through some informal shortcut, or quietly disabled by the very people it was meant to protect. A theoretically excellent control that nobody actually follows provides essentially none of its intended protection, regardless of how sound its underlying design is.
This is a specific, recurring failure pattern: a policy requiring frequent, complex password changes that pushes people toward predictable patterns or written-down copies; an approval workflow so slow that people find informal ways around it entirely. The mechanism wasn't flawed in its stated logic — it simply asked more of people than they were willing to sustainably give.
Designing for real-world adoption as part of the security problem
This isn't an argument for weakening security to make it more convenient at any cost — it's a recognition that a mechanism's real-world effectiveness is inseparable from whether people actually follow it, which makes usability a genuine part of the security design problem rather than a separate, secondary concern to address afterward if time allows. A control designed without attention to how bearable it is to use in practice is, in a very real sense, an incomplete design.