My new mantra when designing security systems needs to be "you are not the user." Below is a link to a great article that includes the kinds of tasks that the different user skill levels can handle. This should be mandatory reading for all who design systems.
"What does this simple fact tell us? You are not the user, unless you’re designing for an elite audience. (And even if you do target, say, a B2B audience of nothing but engineers, they still know much less about your specific product than you do, so you’re still not the user.)"
