The Common Access Card establishes a strong, phishing-resistant identity at login, but it cannot indicate who is at the keyboard later in a shared workspace with the card still in the reader. Derived credentials and mobile alternatives change where the card is presented without changing what the credential proves, which is a single event at the start of a session. DoD Zero Trust target activities call for continuous authentication and user activity monitoring because the interval between logins is where assurance is missing. MagenTrust does not replace the card; it covers the interval after it without adding endpoint hardware. There is no reader dependency, no second device, and no data egress, since the runtime deploys inside the perimeter including air-gapped networks. No PII or biometric template is retained, only derived statistical aggregates. Each verdict is a signed, timestamped decision record that flows into existing SIEM tooling as audit evidence.