The software does not properly verify that a critical resource is owned by the proper entity.