Access decisions have become a critical vulnerability in identity security, as authenticated requests can be approved without a full understanding of the associated risks. This oversight can lead to damaging security breaches, even in the absence of zero-day exploits or advanced techniques. In many cases, hackers gain access by logging in with legitimate credentials, rather than relying on sophisticated technical exploits. This highlights the importance of robust access control measures, including thorough risk assessments and informed decision-making. The consequences of inadequate access decisions can be severe, with breaches potentially occurring before defenders have a chance to respond1. Ultimately, the weakness in access decisions matters to security practitioners because it underscores the need for a more nuanced approach to identity security, one that prioritizes informed access control and risk management.