Step-Up Authentication
Asking for an additional authentication factor mid-session, right when a user attempts something more sensitive than their original login justified.
Step-up adds friction only where it matters instead of demanding every factor all the time — a session strong enough for browsing isn’t automatically strong enough for a high-value action. It’s the fixed-rule predecessor that risk-based authentication generalizes into a continuously computed score.