To eliminate the fish in the barrel factor, I would promulgate security standards for schools, stores, bars, etc. Such as, required minimum response time for armed response, minimum number of patrolling armed security per X customer/crowd, etc. based on limiting the damage.
This is similar to FAA regulations that require 2 people in the cockpit at all times, or X people on duty at power plants and fire stations.
Also, we already have standards for maximum response time for fire response so it is in line with what we do for other threats.
Leave it up to the end users how to implement (hire dedicated armed security, train and arm existing staff, train security to do the job, collaborate with police forces, etc.).
We have comprehensive planning of egress and fire exits, automatic fire doors, and we even build buildings accordingly from the very beginning to mitigate fire risks...my previous building had to be redesigned because the fire marshal said the staircases couldn't extend between 2 floors. All based on hard historical lessons and based on understanding that eliminating the threat is impossible but we can do things to limit the damage. People still die in fires, but we don't have half a city burning down anymore or whole theaters full of people burning up. Meanwhile we basically do nothing at all to manage risk of violence.
I want to live in a future where the AHJ inspects a new building and say "these cubicles don't count as class 1 cover because they won't stop rifle or pistol rounds. But they do count as concealment. You are going to need 1 armed security unit per floor, or else manned video security with 5 minute dispatch time. You can extend it to 10 minutes if you implement all-hands active shooter threat mitigation training. By the way, your fire extinguishers are past inspection. "
