Mechanisms exist to verify the identity of a user before modifying any permissions or authentication factor.
Does the organization verify the identity of a user before modifying any permissions or authentication factor?