In which phase of the identity and account lifecycle are the access rights assigned?