e.vasquez@acme-corp.com authenticated from Austin, TX (corporate laptop · known device) at 01:05, then from São Paulo, BR (unknown device · Okta session ID: okta-9fx3) at 01:13 — 8 minutes and 8,900 km apart. Physically impossible. No travel booked in expense system. The São Paulo session was automatically terminated and Elena was required to re-authenticate via MFA on her known device. Action was instant and reversible — if the São Paulo session was legitimate (e.g., VPN misconfiguration), Elena can re-verify.