A network engineer is deploying posture services in ISE for corporate Windows endpoints connecting via wired 802.1X. When a compliant endpoint first authenticates but has never run posture assessment, the engineer wants ISE to redirect the user to install the agent and remain restricted until assessment completes. Which posture session status should the authorization policy match to trigger the redirect to the Client Provisioning portal?