proof of control operation . irrelevant hr vacation calendar does not demonstrate identity control effectiveness . contradictory evidence shows a privileged user without mfa while policy claims coverage . partial evidence covers some systems but omits contractors and break glass accounts .