Because directory data is regarded as low-sensitivity, its access controls are often loose, for example allowing bulk exports or lacking fine-grained permissions.