After further consideration and some code review, I have decided to remove the policy check here altogether in 7e31424119d95e9f0730dd6cc8e3c805758b974e. We simply don't have a use case for applying security policy checks to service credentials in the context of MFA, so the safest thing is to revert to the existing behavior. If requirements come to light, we will have the needed guidance to implement suitable behavior.