ZTNA proxy policy on Fortigate can't block active sessions when endpoint's Tag is changed

Hello,

We have recently installed the EMS server and connected it to Fortigate. We created a 'proxy policy' to allow traffic from endpoints to the ZTNA proxy. In principle, everything works fine. The EMS server successfully assigns tags to endpoints and synchronizes them with Fortigate.

However, the issue arises when an endpoint changes its tag — for instance, if it becomes vulnerable. The active sessions for that endpoint are not blocked. The endpoint can still access network resources, even though it should be blocked based on the new tag.

Thanks in advance