Checking permissions against a live, current source at the moment of a request, rather than relying on a permission model baked into an index and refreshed on a schedule.
The only enforcement mode that doesn't leave a window between a permission change and its actual effect — required for any system with volatile membership, per CON-G08.