Combine multiple telemetry signals into a real-time risk score, and allow the policy engine to demand step-up authentication when the score increases.