Are there best practices documented (with a good example) of using Authentication Policies and Silos to aid credential tiering? I've seen examples online (mostly in lab environments) around restricting T0 accounts logging onto anything other than T0 (either defined by silo or within policy) but I feel there is more than can be done there.