Zero Trust Access Policies for IoT Must be Granular