1. A non-transitory computer-readable medium embodying a program executable in a computing device, comprising: code that generates a plurality of stored behavioral events associated with a user identity based at least in part on an action of a user at a client device; code that, in response to receiving an assertion of the user identity, monitors a plurality of behavioral events expressed by the client device relative to a plurality of resources of a first network site; code that performs a comparison between the plurality of behavioral events and the plurality of stored behavioral events; code that determines an inverse identity confidence score as to whether the user identity does not belong to the user at the client device based at least in part on the comparison; and code that authenticates the user at the client device to access a resource of a second network site based at least in part on determining that the inverse identity confidence score does not meet a threshold.