The same real person, previously two separate identities
Identity reconciliation merges or matches identity records from two systems being brought together — during a company merger, a platform migration, a consolidation of previously separate tools — so that the same real person, previously represented as two separate identities in two separate systems, ends up as one coherent identity afterward rather than remaining two, or worse, silently combined in an unintended way that grants access neither original system meant for them to have.
This is a genuinely distinct authorization problem from anything either original system's own access control was built to solve, because neither system's design ever anticipated needing to reason about the other system's identities at all — the reconciliation logic is new, purpose-built work, not something either system's existing access control does automatically.
Two symmetric failure modes, both silent until discovered
The failure modes run in both directions and are equally real: two different people who happen to share enough attributes get incorrectly merged into a single identity, combining access that was never meant to belong to one person; or one person's two legitimate identities are treated as unrelated and left permanently duplicated, leaving stale, forgotten access active in whichever system nobody remembered to clean up afterward. Neither failure announces itself — both simply persist quietly until something unrelated forces someone to notice.
Getting this right requires treating reconciliation as a deliberate project with real verification built in, not an incidental side effect of whatever migration tooling happens to be moving the data across — the identity questions are exactly as consequential as the data itself, and deserve exactly that level of deliberate attention.