The weakest link in enterprise identity is the service desk. An attacker calls claiming to be a locked-out employee, applies time pressure, and asks a human to reset a second factor — and the human is the control. This models the replacement: evidence scored into an assurance ledger, weighed against the blast radius of what is being asked, with attack indicators that subtract rather than merely annotate. The passport check digits are computed for real.