The failure is caused by an unstable trusted-network signal, so the trusted definition and associated forwarding decisions must be corrected. Zscaler’s Trusted Network search reference lists default gateway and egress IP among the available criteria. Combining stable campus properties prevents the public DNS-resolver change from intermittently classifying on-campus devices as off-trusted. Zscaler’s Forwarding Profile guidance supports applying different forwarding behavior according to trusted-network status. Option B then makes policy intent explicit: HR and SIP bypass only after the campus match, while the following off-trusted rule forwards those applications for inspection when users roam. PAC fallback or proxy enforcement adds another decision path without repairing detection. Relaxing posture checks does not identify the network and would weaken device controls.