Session-level policy is a set of access rules evaluated separately for each login or connection session. Instead of making a one-time decision based only on a password, it can check identity, device posture, location, risk signals, or whether the endpoint is managed before granting access. In zero-trust systems, this helps move authorization from the network edge to the individual session.
This matters because attackers often steal credentials or abuse trusted devices. If access is decided per session, a valid account does not automatically mean broad or permanent reach. Defenders can require step-up authentication, block high-risk devices, or limit a session to specific apps and services. In practice, session-level policy is common in VPN replacements, privileged access tools, and cloud application gateways where each connection must be re-evaluated rather than trusted by default.