An enterprise runs Cisco ISE with profiling enabled. A workstation initially connects and is placed in a limited VLAN because ISE has only collected partial DHCP and RADIUS attributes. Moments later, ISE receives additional CDP and DHCP data that reclassifies the device into a trusted 'Corporate-Workstation' profile with a more permissive authorization profile. Which mechanism allows ISE to enforce the new authorization result on the switch port WITHOUT requiring the endpoint to physically disconnect and reconnect?