Comment by Gnobu

That makes a lot of sense especially the focus on correctness. What you described is interesting because even with multiple login paths (IP, SSO, credentials), you’re already adapting identity based on context, just in a structured way. I guess the challenge I’m thinking about is what happens after login — when behavior starts to shift. Do your systems treat identity as stable at that point, or do they continue adjusting based on what the user is doing?