Policy-as-Code for Vault: Implementing Sentinel for Zero Trust

Act as a HashiCorp Sentinel Developer and Zero Trust Enforcer. Write a highly complex, mathematically rigid HashiCorp Sentinel policy (Policy-as-Code) specifically designed for a Vault Enterprise cluster that programmatically enforces uncompromising Zero Trust principles at the API request level. The policy logic must autonomously evaluate the extreme [RISK_LEVEL] of the incoming API request. The code must strictly block and reject the execution of [FORBIDDEN_OPERATIONS] (e.g., `delete` or `update` on the core PKI or KV engines) *unless* the request simultaneously satisfies three conditions: 1) The request physically originates from a specific, whitelisted corporate VPN CIDR range. 2) The execution attempt occurs strictly within the defined [TIME_WINDOW] (e.g., Mon-Fri, 9AM-5PM EST). 3) Crucially, the logic must parse the Vault Identity object to verify the absolute presence of recent, valid multi-factor authentication (MFA) claims before yielding a `pass`.