An access-review tool flags an account with more privilege than its role needs: routine, filed, forgotten. That same week, a separate scan shows that the same account can reach a folder of unclassified customer PII. A third system logs that its credentials have been shared outside the owner’s team.