What do the OS X authorization mechanisms actually do?
Solution 1:
From what I recall loginwindow:login is actually used in spawning the GUI login window, similar to builtin:policy-banner. So it is logical to be spawned before the rest of the actions. So the GUI window is the one that is actually irrelevant/bypassable, not the credentials themselves.
What exactly would you like to modify and towards what purpose ? For example, if you require the authorization plugin to be invoked in other situations, you can do that by editing auth.db.
Also, builtin:authenticate sub-systems should handle differencing between 802.1X and local auth.
Solution 2:
builtin:forward-login,privileged
Forwards the successful FileVault login to the OS X Login Window and bypasses the need to login there. It's kind of like single sign-on. I disable this in my environment since it wasn't using the 802.1X profile I had setup. I would try doing that.
OS X: How to disable automatic login when FileVault is enabled
sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLogin -bool YES