Bind Access Grants to Stable Principal Identifiers
An application may grant access to alex@example.test and appear to work correctly for years. Then Alex changes address, leaves the organization, or the old address is assigned to someone else. If the authorization system treats that address as the identity itself, access can follow the label instead of the person or service that was originally approved. This is an identity-binding problem. Authorization needs to answer not only what may this requester do? but also which principal does this grant actually belong to? A principal is the security identity that receives permissions, such as a user account or service account.