Access control is the control every other control depends on. If the wrong person can authenticate, nothing downstream holds.
We built a robust authentication and access control system combining multi-factor authentication with role-based access control, so that only authorised personnel have access to sensitive data — backed by two-step verification, tokenisation and session-based authentication.
Roles were modelled against how the organisation actually works, so least privilege did not turn into a queue of exception requests.