Techniques are described in which for a user to obtain access to or entitlement to objects or locations, such as for example a web application or entry into an accounting office, the system derives a unified risk score associated with the user. The computer compares the unified risk score against a set of rules to determine whether the unified risk score is greater than a particular threshold. Based on such determination, the computer can cause denial of access or entitlement for example by denying entry to the web application or transmitting a denied message to a system that controls the physical lock on the door to the accounting office. In generating the unified risk score, the computer retrieves the most up-to-date identity information about the user by signing on to an aggregator system using any supported login identity provider username and password or other authenticating credentials associated with the user.