How can I prevent access to Authelia's setting page after just 1FA?

I setup a passkey, totp, and require 2FA for my sites. I want Authelia's settings only to be accessible via 2FA. This is the portion of my config that I thought would lock it behind 2FA but it's not working. I can still access the settings via my username and password alone. identity_validation: elevated_session: code_lifespan: '5 minutes' elevation_lifespan: '10 minutes' characters: 8 require_second_factor: true skip_second_factor: false access_control: default_policy: 'deny' rules: - domain: "auth.domain.