Your organization is adopting a Zero Trust security model for Microsoft 365. During a design review, a colleague argues that once a user has authenticated at the start of their day, the system should trust all subsequent requests from that user's session without re-evaluating signals like device health or location. Which core Zero Trust principle does this argument violate?