The person logging in is not always the customer.

Login proves who is at the screen. It does not prove what they own, may manage, or can buy. Model those questions separately before the edge cases arrive.