An organization currently relies heavily on network ACLs and perimeter firewalls as its primary trust control. A security architect wants to justify a shift toward identity-based access. Applying both the immutable laws of security and the laws of cybersecurity risk together, which principle best supports reducing dependency on network trust as the primary control plane?