MFA Auth with enforcement via RLS