AC.L2-3.5.2[b] — The identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access.