Access management is required to have identity assurances. If there's no way to ensure someone's identity is secure, how do we know it's them in the first place?