In physical world, access control is done by certain barrier that this barrier will be disabled for entry by authenticated individual.
The same applies in cyber world.
Access control in both worlds are to manage “honest” users but not malicious users intentionally bypassing the barrier(s). The laws & regulations are the last resort to stop offenders.