Identity controls decide who can act inside an organization, and the real risk often comes from access that lingers long after it is needed.