Private-app access is re-evaluated on every request, not only at login.

Requests to private apps, and to web apps behind the sign-in check, are decided each time: group membership is re-read and the access rules are re-run on each request. Each access token is resolved on every call.

Group finance · App finance-app · Device tier trusted · Score 100 · Risk label none

1. Finance app: finance group, trusted device, score at least 70, weekdays 09:00-18:00 UTC — matched, decided here
2. Deny impossible travel — not evaluated: an earlier rule decided
3. Decision: Allow

What this does not show: your policy, other request contexts, or combinations the posture model cannot produce.

Text version

1. Allow (the finance app rule: finance group, trusted device, a minimum score, weekday hours)
2. Deny (impossible travel)
3. No match: deny (the sample set's fallback)

With its switch on, the broker scores each request for risk. Impossible travel adds 100, three or more recent failed attempts by the person or from the address add 50, and a country outside the administrator's home list adds 40. At 60 or more the verdict becomes Step-up: the request needs a sign-in no older than 300 seconds. Adaptive step-up only raises a request that would otherwise be allowed, so a Deny stays a Deny. Our reference deployment turns it on.

What this does not show: the reputation and country weights, or risk bands beyond one threshold (roadmap).

Text version

Time	Event	Score	Decision
Start	session open	0	Allow
Later	impossible travel detected	100, at or above 60	Step-up required (fresh sign-in no older than 300 s)
Then	user completes step-up	—	Allow
After	next request	—	Allow (that sign-in is still fresh)

Bands beyond one threshold are on the roadmap. Roadmap

Action	What it ends
Revoking one session, or signing out everywhere	The sessions. Access tokens already issued stay valid until they expire, 300 seconds by default.
Deactivating or deleting a person	Their sessions, their renewal tokens and every access token issued to them. Their live direct connections are cancelled, not merely refused next time.
Revoking a device	Its enrolment and the sessions signed in from it.
Disabling, re-scoping or removing a direct-connection application	The live direct connections to it are cancelled.
Disabling an AI agent	It stops new tokens; tokens already issued stay valid until they expire.

Live direct connections are the browser SSH terminal and connections that desktop tools forward.

With runbooks switched on, the broker reacts to a posture drop, a reused refresh token, a non-compliant device, repeated failed sign-ins and impossible travel. Runbooks record a recommended response and apply nothing.

Applying one needs a second switch and a rule for that signal that opts in; then the broker can revoke a reused refresh-token family or quarantine the device. A recommended step-up is only recorded. Our reference deployment turns runbooks on and leaves that second switch off.