Which responsibility always remains with the customer across all cloud models?

Managing data access and identities is a customer responsibility across all cloud models (IaaS, PaaS, SaaS). This is part of the shared responsibility model, where the customer is always accountable for their data and who can access it, regardless of how the infrastructure is managed. Securing the hypervisor and patching the host OS are typically provider responsibilities in PaaS and SaaS, and often in IaaS too, depending on the specific service. Controlling physical access is always the cloud provider's responsibility, as they own and operate the data centers.