It is pretty straightforward, but it is hard to rework it back into your architecture without a lot of impact. If you know that you need this capability at the beginning of a project, you're probably good, but if you need to go back and add Shield, you're in a little bit of trouble. It all depends on the number of users you have and the type of application, but you're in a much different spot if you're having to go back and rework it. For maintenance, you would require one cloud engineer for Shield in the environment, especially if you're doing anything at scale with that. You would also require a part-time architect person for overall oversight of that Shield capability. The architect's role would be more attending meetings and confirming that something is good, and it aligns with Shield capabilities, and Shield can be used for this application. The engineer's role would be more along the lines of the day-to-day implementation based on the application.