Every login is verified, every session is auditable, every access is logged.
Two-factor authentication is required for every session.