The broad Allow rule is shadowing the posture-dependent decision. Zscaler’s Access Policy documentation describes rules that combine users with applications or segment groups, and ZPA evaluates applicable rules according to policy order. A general rule that matches first can grant access without requiring the device to satisfy the intended posture condition. Moving the posture-based rules above the broad Allow ensures compliant devices receive the appropriate access decision and non-compliant devices fall through to a block or a more restrictive rule. The administrator should then test both compliant and non-compliant endpoints and confirm the matched rule in diagnostics. URL Filtering governs internet destinations, not authorization to private ZPA applications. User-group and time restrictions can reduce scope but do not establish device compliance. Option D directly restores the required compliance-before-access evaluation.