Your mission, should you choose to accept it, is to see how the M:I series has some pretty interesting lessons on how to do identity-based security right (or wrong).