Your directory says who they are. The application decides what they can do. The day a hidden menu hides access, the app still answers unauthorized requests. • Central authentication does not give you central authorisation • Application roles must be visible to entitlement review, not buried in code • Every check is server-side; hiding UI elements enforces nothing CISSP Domain 5: Identity and Access Management (IAM) #CISSP #IAM #CyberSecurity #InfoSec #StudyTips