When Friction Becomes Risk: A Behaviour-Aware Adaptive Access Control Model for Hybrid Workforces

This paper is about a blind spot in how organisations control access for hybrid workers, meaning people who move between the office, home and other places during the week. The problem. Modern security systems make a fresh decision on every login or access request.

They look at who the user is, what device they're on, and where they are. If something looks risky, they ask for extra proof, such as an MFA push notification. Existing research and vendor guidance treat these extra prompts as a small inconvenience.

But people have a limited tolerance for security effort. The more often they are challenged, the less carefully they respond. They approve prompts on autopilot or look for workarounds.

So the control that is meant to protect the organisation gets weaker the more it is used. The gap. The paper argues that no existing model accounts for this feedback loop.

Published reviews say research on zero trust is mostly technical, lacks quantitative real-world evaluation, and neglects user-related factors. The paper's search found the same picture for hybrid and remote work specifically, though that search was not systematic. What the paper does.

A mathematical model. It represents each user's attentiveness as a quantity that drops with each challenge and recovers with rest. It proves that asking for extra proof more often can make the organisation less secure, not more.

A simulation. It tests the model on a synthetic workforce of 400 users over 60 days, comparing three policies: Challenge every request. This came out worst.

Adjust challenges by risk only. Risk was lowest at a moderate level of strictness and rose again beyond it. Also adjust to the user's fatigue.

This gave only small gains when the settings were well tuned. It limited the damage when the settings were too strict, and it slightly hurt when users were robust to friction. A study design.

It proposes a real-world field study across several organisations to measure these effects with actual login data. Important limits. The simulation results come from parameters I assumed, so they show how the mechanism works but are not evidence about real workplaces.

The gap analysis is provisional until a proper systematic review is done. The paper is a theory-plus-simulation draft, and a top journal would likely expect the empirical study as well.