Self-service Moved the Identity Boundary Onto the Employee

The payroll redirection at 25-1009b worked because a person with an employee’s credentials could change where that employee’s salary was paid, without an administrator approving it.

MFA enrolment at 25-0813: adding a device is designed to be easy, available to any authenticated session, and grants standing authentication capability.

Application consent at 25-0311: a security decision routed to whoever happens to be logged in, in a routine path, correct 999 times out of 1,000.

Bulk retrieval at 25-0612: a legitimate account performing a permitted action 300,000 times, with no volumetric limit to notice.

And now a payment destination change. In each, an organisation moved an operation from an approval path to a self-service path, for good operational reasons, and the operation retained consequences that warranted approval.

Self-service is not a convenience feature with a security cost. It is a decision about who holds authority for an action — and the corpus’s repeated finding is that these decisions are made by product and operations functions on efficiency grounds, and are never revisited when the threat model changes.

What would help is a category rather than a control: identify the operations that are irreversible or financially consequential, and exclude those specifically from self-service regardless of how routine they are.

That file proposed a permission model distinguishing actions an agent may take alone from actions requiring a human decision, and observed that a confirmation dialogue becomes reflexive.

The same distinction applies to human self-service, and the corpus has now recorded four 2025 incidents turning on its absence. Graded medium: this is a generalisation across incidents, not a finding from a source.