Mechanisms exist to verify the identity of a user before modifying any permissions or authentication factor.