You suspect that some users may have been granted access to critical resources without being subject to the expected Conditional Access policies. This could indicate a misconfiguration or intentional bypass, leading to potential security vulnerabilities.