A hospital deploys Cisco ISE to enforce access policies on wired ports. Medical IoT devices such as infusion pumps cannot run a supplicant and are onboarded via MAB. Once ISE profiles a device as a known infusion pump, it must immediately move that endpoint into a restricted medical VLAN without requiring the device to be unplugged or manually reset. Which ISE capability makes this dynamic re-enforcement possible after the initial MAB authorization?