conditional access
termcloudsecurity
Sign-in policy with context: who, from which device, from where, at what risk level - and only then, with which second factor, access.
The identity layer's traffic light: green from the managed laptop, challenge from the café, red from the impossible country.