Zero Trust secures access. Authority Control secures consequence.
Authority Control does not prevent credential compromise. It prevents compromised credentials from creating unauthorized consequence.
Authority Control does not protect the token. It protects what the token is allowed to do.
Authority Control introduces a structural constraint where one has not previously existed.
Access controls have grown more sophisticated every year. The scale of consequence has grown faster.
Where Authority Control operates
Authority Control is deployed by the organization that defines data authority, owns the data, and controls the integrations that move it. The customer holds the defining role. Authority Control enforces what the customer has defined.
This is deployable today against existing data exposures, without waiting for platform vendors. Every SaaS integration, every delegated token, every automated pipeline that moves data is a commitment surface where Authority Control can be applied at the customer edge.
Where the gap appears
Access controls pass. Authority over consequence remains open. Access is verified. Commitment is not.
Current Exposure
OAuth tokens used for a legitimate Drift-to-Salesforce chatbot integration were used to extract Salesforce data across 700+ customer organizations. Every enterprise that consumes OAuth-mediated SaaS integrations carries this structural exposure today.
Zero Trust verifies the token and the session. It does not evaluate whether the bulk export action matches what the integration was trusted to do. Authentication is not authority.
Compromised tokens cannot create consequence beyond the authority scope defined for the integration. The exposure of a compromised integration is bounded by what the integration was authorized to do, not by what its credentials technically allow.
Who deploys: The Salesforce customer, not Salesforce itself. No platform vendor cooperation is required.
Current Exposure
Every healthcare processor, payer, and clearinghouse carries this exposure today. Authenticated access to processing systems can still create catastrophic data-movement consequence unless bulk extraction is evaluated as a distinct authority class before execution.
Attackers accessed Change Healthcare systems and exfiltrated data for 192.7 million individuals, including medical data, SSNs, and insurance information.
Zero Trust verifies credentials, network paths, and application access. It does not evaluate whether a specific bulk data movement request falls within authorized commitment scope at catastrophic volume.
No single identity holds authority for consequence at that magnitude. The blast radius of valid access is bounded by what the identity is authorized to move, not just by what the systems can technically export.
Current Exposure
Every enterprise running third-party APIs and SaaS integrations carries this exposure today. A path that serves one legitimate lookup can also serve millions of records unless lookup and bulk extraction are governed as different commitment classes.
Attackers exploited misconfigured API permissions in a third-party Salesforce integration, exfiltrating SSNs and credit data for 4.4 million customers.
Zero Trust verifies the third-party integration, the Salesforce environment, and the API path. It does not evaluate whether the bulk export action matches what the integration was trusted to do. Authentication is not authority.
A third-party integration cannot create data consequence beyond the authority scope defined for it. The exposure is bounded by what the integration is authorized to retrieve, not by what its credentials can technically reach.
Current Exposure
Overseas support contractors used legitimate access to exfiltrate customer data for 69,461 users, including partial SSNs and ID images. Their data interactions were structurally indistinguishable from legitimate support operations.
Estimated cost: $400 million. Least privilege was satisfied. Least authority was absent.
Zero Trust verifies contractor identity, role-based access, and the application path. It does not evaluate whether viewing, copying, and exporting fall within distinct authority classes at aggregate scale.
A support identity cannot create data consequence beyond the authority scope defined for it. The exposure is bounded by what the identity is authorized to move, not just by what the systems technically allow.
Access narrows reach. Authority narrows consequence. Together, they bound blast radius as a function of two independent dimensions.
- 1. ITRC, 2023 Annual Data Breach Report (18th edition), released January 25, 2024; 3,205 compromises and 353,027,892 individuals impacted.
- 2. ITRC, 2024 Annual Data Breach Report (19th edition); 3,152 compromises and approximately 1.35 billion individuals impacted.
- 3. ITRC, 2025 Annual Data Breach Report (20th edition), released January 29, 2026; 3,322 compromises and 278,827,933 victim notices.
- 4. IBM Security and Ponemon Institute, Cost of a Data Breach Report 2024; average U.S. breach cost of $9.48M for 2023.
- 5. IBM Security and Ponemon Institute, Cost of a Data Breach Report 2025; average U.S. breach cost of $10.22M for 2025.
- 6. Compiled from SEC filings, FTC enforcement actions, and company breach disclosures.
- 7. Anthem Inc., breach notification filing, February 2015; HHS Office for Civil Rights.
- 8. U.S. Office of Personnel Management, cybersecurity incident disclosures, 2015.
- 9. UnitedHealth Group and Change Healthcare breach disclosures, 2024.
- 10. National Public Data breach disclosures and reporting, 2024.