Others had only trivial barriers to that access, such as requiring that a visitor sign in with any email address
my company made one of these AI apps, and when I signed up I realized there was no email verification.
so, I made a fake user, with fake credentials, and an email that doesn't even exist, and it worked. oh, and it has default editing permissions, so I was able to change data in it.
it won't allow the use of an email outside of the company domain, but here's the kicker: there's a pop-up notification that tells you what domain to use.
it's been 3 weeks, and it hasn't been deleted yet.