A manufacturing company is retiring its legacy VPN concentrator, which grants remote employees full network access once authenticated. Leadership wants remote workers to reach only the specific internal web applications they are authorized to use, with per-session access decisions based on user identity and device health. Several of these internal applications are legacy systems that cannot support modern authentication protocols or install any agent. Which architecture best meets these requirements?