To combat sophisticated threats, we need to improve how we approach authorization and access controls.