Your security architect approves a new federated login path for a customer portal. The design uses a single global identity provider for SSO and token exchange, with no jurisdiction flags on the assertion payloads.
The first production login crosses three cloud regions before the session token lands in the Australian tenant. Residency rules are treated as a storage problem, not an identity routing constraint.
Downstream services inherit the foreign assertion without re-signing inside the required boundary. Audit logs show the origin but offer no way to block or reroute the flow at runtime.
Procurement signs the contract with the identity vendor on uptime and price. No clause requires token endpoints or refresh flows to stay within Australian data centres or to declare their path on each exchange.
When the residency audit arrives six months later, the team faces a choice: rip out the federation or accept ongoing leakage. Neither option was costed in the original delivery plan.
The fix is not another policy document. It requires identity platforms that embed jurisdiction as a first-class claim and reject any assertion that cannot prove its path stayed local.
Security stops being a delivery constraint only when architects treat every token exchange as a potential cross-border event instead of an assumed internal hop.