Every access check passes. The consequence is ungoverned.
Six cases across finance, infrastructure, supply chain, and telecommunications. Each follows the same structural pattern. Case labels are under reconciliation against the incident inventory; statuses are marked per case.
Zero Trust verifies access: who can get in, from what device, through what network, and under what conditions. It does not verify whether the actor holds organizational authority for the consequence created through the system they accessed.
That gap sits at the commitment boundary, the moment a system action becomes a real organizational commitment. The following cases show what happens when access is verified but authority is not.
Each “Authority enforced” analysis below is a reconstruction, built only from the organization’s own documented pre-incident authority policy, never from hindsight. Reconstructed analyses are presented as what the documented policy already required; they are distinct from the native records a deployed system produces at the moment of commitment.
Authority Control does not detect malware, credential theft, or anomalous behavior. It uses identity, integrity, provenance, and approval signals from existing controls to determine whether a proposed commitment has authority to proceed. In software supply-chain cases, Authority Control does not identify malicious code. It determines whether the release still carries sufficient authority and evidence to proceed.
+Network Compromise Bangladesh Bank · finance · 2016Reconciliation pending
Attackers used stolen SWIFT credentials to submit 35 fraudulent transfer requests totaling $951 million. Five transfers totaling $101 million were processed before a spelling error triggered manual review.
$81 million irrecoverably transferred. Each was a financial commitment that passed every access control in the chain.
- Authenticated SWIFT credentials accepted
- SWIFT network isolated (closed, trusted network)
- Credentials carried legitimate transaction capability
- Transaction format structurally valid
- Monitoring present (flagged anomalies only after execution)
All access controls pass.
- Apply transfer authority limits per identity
- Use an authorization chain for high-value transfers
- Assess cumulative exposure across transactions
- Route out-of-scope transfers for review or escalation before execution
Unauthorized commitments at that scale do not execute.
+Insider Threat Wells Fargo · finance · 2011–2016Reconciliation pending
Employees used legitimate system access to create approximately 3.5 million unauthorized customer accounts and credit cards. Each account creation was a routine operation within their system permissions.
$3 billion in fines and settlements. Every fraudulent account was a customer obligation the system permitted but the organization never authorized.
- Employee identity authenticated
- Role-based access to account creation systems valid
- Actions occurred within authorized business applications
- Transaction logging active for each account creation
- Individual actions indistinguishable from legitimate operations
All access controls pass.
Every workflow step completed correctly. Authority over the resulting obligation was never evaluated. Workflow confirms process completion; Authority Control confirms authority for the resulting obligation.
- Limit account-creation authority by role and purpose
- Surface cumulative volume anomalies against established authority limits
- Align the action with documented organizational intent
- Create durable attributable records for each account created
Account creation authority constrained by organizational authorization, not just system permissions.
+Supply Chain SolarWinds · software · 2020Reconciliation pending
Adversaries inserted compromised code into the Orion software build pipeline. The tampered update was signed, distributed through legitimate channels, and installed by approximately 18,000 organizations including U.S. federal agencies.
Attackers maintained access to Treasury, Commerce, and Homeland Security departments for over nine months through a trusted software update.
- Build system credentials authenticated
- Pipeline stages segmented and connected via trusted paths
- Code signing infrastructure verified build integrity
- Distribution channels authorized and encrypted
- Monitoring and logging active across build environment
- Endpoint protection present on build servers
All access controls pass.
- Handle each software release as a governed commitment
- Check authority against the intended distribution scope
- Associate the release with explicit authority constraints
- Apply limits to downstream propagation scale
Each release treated as a commitment event with authority verification.
+Financial Services JPMorgan London Whale · finance · 2012Reconciliation pending
Traders at JPMorgan's Chief Investment Office grew a portfolio from $51 billion to $157 billion in notional exposure over one quarter. Internal risk limits were breached more than 330 times. Each breach generated a warning. None prevented the next trade.
$6.2 billion in losses from financial obligations the trading system permitted but the organization never authorized at that scale.
- Trader identity authenticated with institutional credentials
- Access to trading platforms role-authorized
- Network segmentation within CIO trading infrastructure
- Risk monitoring and reporting systems active
- Transaction logging for every trade
- Compliance monitoring and position reporting operational
- No anomalous access behavior detected
All access controls pass.
- Apply cumulative position limits as structural constraints
- Narrow what actions are allowed as risk limits are approached
- Use independent authorization for model changes
- Create durable records linking each trade to verified authority
Risk limits become structural constraints on the next commitment.
+Critical Infrastructure Volt Typhoon / Colonial Pipeline · infrastructureReconciliation pending
Volt Typhoon (2023-2024): a Chinese state-sponsored group pre-positioned within U.S. water, energy, and transportation systems using legitimate administrative tools. Colonial Pipeline (2021): a ransomware attack led to a six-day pipeline shutdown affecting East Coast fuel supply. Both involved operational consequences created through authorized access paths.
Volt Typhoon: pre-positioned for operational disruption through stolen credentials. Colonial Pipeline: $4.4 million ransom paid, regional fuel disruption for six days. In both cases, administrative access translated directly into operational consequence.
- Identity verification passed (legitimate or stolen credentials)
- Device compliance checked
- Network segmentation enforced across infrastructure zones
- Endpoint detection and response active
- SIEM logging and behavioral analytics running
- Workload integrity monitoring present
- Administrative commands issued through valid interfaces
- Living-off-the-land techniques operated within all controls
All access controls pass.
- Check authority for operational commands separately from access
- Apply scope and magnitude limits to physical changes
- Use multi-party authorization for system-wide impact
- Associate commands with approved operational windows and conditions
- Keep administrative access separate from operational disruption capability
Operational commands require authority verification independent of access credentials.
+Telecom & Surveillance Salt Typhoon · telecom · 2023–2025Reconciliation pending
A Chinese state-sponsored group compromised at least nine major U.S. telecom providers, accessing lawful intercept systems through stolen credentials and unpatched infrastructure. They intercepted communications of over a million users including senior political figures.
Audio recordings of presidential candidates intercepted. Sealed court orders identifying active surveillance targets obtained. By 2025, 200+ companies in 80 countries compromised.
- Operator credentials accepted as valid (stolen credentials)
- Network segmentation across telecom infrastructure enforced
- Access to intercept systems role-authorized
- Endpoint protection and monitoring active
- SIEM and security operations center operational
- Data access controls and classification in place
- Requests processed through standard lawful intercept interfaces
All access controls pass.
- Check each intercept action against current judicial authorization
- Associate each request with a specific, validated court order
- Apply scope, duration, and target limits per authorization
- Maintain a verifiable chain from court order to intercept action
Unauthorized monitoring does not execute.
| Identity | Verified |
| Access | Authorized |
| Segmentation | Functioning |
| Monitoring | Present |
| Authority at commitment | Not evaluated |
In each case, security controls verified identity and access and operated as designed. The failure occurred because no system evaluated whether the actor held authority to create the resulting organizational obligation.
See the production deployment example on its own page →
- 1. Federal Reserve Bank of New York; Bangladesh Bank disclosure, 2016; Reuters and Bloomberg reporting
- 2. Consumer Financial Protection Bureau; DOJ; Wells Fargo SEC filings, 2016-2020
- 3. CISA, Emergency Directive 21-01: SolarWinds Orion Code Compromise, December 2020; SEC filings
- 4. SEC, In the Matter of JPMorgan Chase, Administrative Proceeding, 2013; U.S. Senate Permanent Subcommittee on Investigations
- 5. CISA Advisory AA21-201A (Volt Typhoon); Colonial Pipeline, DOJ and company disclosures, 2021
- 6. CISA, Joint Advisory on Salt Typhoon, 2024; congressional briefings and carrier disclosures
The pattern is structural. So is the fix.
Authority verified at the point of commitment, with a durable record either way.