Dynamic Access Policies build a per-session policy by evaluating endpoint attributes such as operating system, antivirus status, and certificate fields together with AAA attributes returned for the user. The resulting policy can allow, restrict, or deny the session based on those combined conditions.