MFA step-up is not object authorization

A second factor proves the person is still at the keyboard. It does not decide whether that person may read, edit, export, or delete a specific resource. The bug pattern A common flow: User tries a s