A textbook 'Authorization Gap': the special exemption granted entry, but failed to bound the user's intent. Identity verified at the gate is no longer a proxy for authorized behavior.