What is a security system supposed to do when provided with the correct login credentials?

I’m gonna go with not give that user access to millions of other users’ personal information…

I get your point and agree, but having a valid login shouldn’t provide that kind of access.