When identity isn’t the weak link, access still is