They should verify which identity attributes are authoritative, how updates are reviewed, and whether user-managed data can alter access without governance checks. Self-service can reduce operational overhead, but without clear attribute ownership it can also weaken policy enforcement and make access decisions harder to trust.