Most Basic Flaw
A telephone book does not claim to tell you whether a person should have access to classified information.
It does not even tell you which Bob Smith is your old friend Bobby from summer camp.
It gives clues but lets you do trial and error.
Access control needs more than weak clues.