When a server becomes critical, access policy should follow its real risk, with stronger MFA, visibility and traceability where it matters.