Enforces password, session, two-factor and payment rules, with an audit log.