I've recently started using LastPass and one of the things you can set as a policy for you password vault is
Prevent offline access when using Google Authenticator. The local cache can be accessed without a second factor when using Google Authenticator [unless this policy is enabled]
How can they enforce that? If they somehow encrypt my password db with a key returned by the google authentication procedure then how can they allow offline access in the first place? And if they don't encrypt it with something from google then how can they prevent offline access?