When Edward Snowden walked out of the NSA in 2013 with thumb drives full of its most secret files, the agency didn’t have a reliable list of people—like Snowden—who had privileged access to its networks. Nor did it have a reliable list of those who were authorized to use removable media to transfer data to or from an NSA system.