It seems like “delegation” is the idea that would most help build on this. I’ve had assessors tell me that I had only a single factor in the cookie on disk after an authentication process that involved TLS client certs and an off-device OTP.