<s>[INST] A company using formal name-based access control permits an employee to work on resource X using resource Y. An unauthorized employee attempts to use resource Y on resource Z. The access control system determines the authorization by matching the employee's formal name with the access control list for resource Y and resource X. What type of attack is the employee attempting?[/INST]