I have to wonder why shuttle launches are an "allow unless we stop it" situation instead of an "only launch with authorization" situation.
But people stealing shuttles do have authorization in the general case! It's almost invariably a high-ranking member of the crew doing the dastardly deed. Exceptions really are rare: there's the "Profit Motive" Ferengi, who no doubt could buy authorization, plus the pants they're wearing, off the saps supposed to be guarding the facility while blindfolded and hands tied behind their backs (I mean the Ferengi - the guards probably aren't allowed to play games like that). And then there's Jake Kurland from "Coming of Age", who supposedly had permission to learn shuttle flying.
That there should also be a separate specific clearance from the bridge to launch the shuttle (or perform the beaming) before any of the buttons work... Well, it's a good idea, and would change little or nothing. An authorized person calls for permission; a bridge officer grants it with the press of a key. It's generally only then that it turns out the request was malicious anyway: we've seen how this authorization thing works in TOS/TAS (keycards) or TNG (voice recognition), and as long as the person does belong to the group of authorizeds, his or her exact identity doesn't and shouldn't trigger any alarms.
I mean, should Character X have been preemptively flagged as "not permitted to leave the ship by any means" in Episode Y? Hardly a priority with, say, Commodore Decker (they did assign him an escort but pussyfooted around his status), and certainy not plausible with Jake Kurland.
That it should be difficult to abort an already initiated shuttle launch procedure is sound as such: you really don't want the doors crushing any shuttles, no matter how illegally departing, or all the complicated stuff going on with onboard air and gravity disrupted at a bad moment.
How about security codes? With telepathic species and other such threats running around, one would think that updating the security codes would be a priority? But, rarely do they update them, if the codes are there in the first place!
OTOH, what good would codes do with telepathic species and other such threats running around?
Really, we could well expect any code to be just a delay of twenty seconds for a tricorder-wielding adversary. Which is why we basically never have such - and when we do, it's Evil Data stuff, pitting superbrain against superbrain.
Things like Tango Foxtrot Jive after the name of the character identifying herself aren't for identification (the voice recognition takes care of that already), but for bookkeeping (has she duly changed her codewords for this week, indicating she has also done the other formalities such as the drug test and the security reclearance?) - it should be exceptional for a recognized crew member
not to have the authority to do something that everybody else can do. Autodestruct, say, shouldn't be behind lock and key (actual code bumbers), but behind a pane of glass (the unchanging strings of numbers in TOS "Let" and ST3:TSfS) that makes the user think twice before proceeding but won't stop her from achieving her no doubt vital goals.
And "Ardra" grabbed him off the bridge, too. In pajamas.
...Exactly the sort of situation where computer notification would only serve to embarrass everybody.
Timo Saloniemi