Sure, if they helped you figure out a way to build, that would be fine. Far more often, I am just told to kill feature/bugfix/concept. At a past job, the security people were against the idea of self password reset at all.
The security team at my current company also refuse to allow self password resets. The only way is to call our service desk and give them your DoB and last 4 of your SSN... and they completely ignored me when I pointed out that for at least half the population the US that information is more or less public due to several data leaks.