Yes, when the identity and source systems provide reliable permissions that can be enforced.