A use-case guide turns into a sharper lesson: identity security tools only work when they match the way an organization actually authenticates, escalates privilege, and moves trust around.