A remote-access design uses MFA but grants every authenticated user access to all internal services. What gap remains?

1. The need to remove MFA
2. Authorization and least-privilege segmentation after authentication
3. A requirement to publish the internal network map
4. Proof that all internal users are trusted for every action