Static Review Is Not Enough: Why Conditional Access Needs More Than Defined Test Scenarios

If Conditional Access behaviour depends on sign-in context, client path, device state, service dependencies, and policy interaction, then static review alone is not enough. Defined scenarios help, but exhaustive deterministic simulation goes further.