Review zero trust exceptions from access reason, device posture, network zone, duration, and compensating controls