No exceptions, on principle
Complete mediation is the requirement that every single access to a protected resource passes through an authorization check — not most accesses, not the ones that happen through the primary interface, all of them, without exception for internal paths, cached decisions, or components assumed to be trustworthy enough not to need checking. Stated this way, it sounds almost too obvious to need naming. In practice it's one of the easiest principles to quietly violate.
The violations are rarely deliberate. A component checks access once at the start of a multi-step operation and reuses that decision for every step, on the reasonable-sounding assumption that nothing relevant changes mid-operation. An internal service trusts requests from other internal services without a check, because they're 'inside' the boundary already. Each shortcut is individually defensible and collectively erodes the guarantee.
Auditing for where mediation actually happens
Confirming complete mediation in a real system means tracing every path to a protected resource and confirming a check happens on that specific path — not assuming that because most requests go through a well-checked front door, every request does. Internal tooling, debug endpoints, and administrative back-doors added for operational convenience are the most common places the principle quietly stops applying.