This is a layer on top of normal security, so this isn't a matter of compromising the "brain" instead of RBAC, etc, but in addition to.

Attribute-based access control is already a thing. User X logs in the US East between the hours of 6am and 6pm. If User X logs in from Russia at 3am, deny access. This seems like an evolution of that pattern