What it asks for. User sessions must be automatically terminated after defined conditions or trigger events, such as inactivity or targeted attack responses.
In practice. Doing this well means session timeouts in applications and identity providers sized to risk, session revocation when accounts are disabled or compromised, and limits on token lifetimes. Auditors look for configured timeouts, token lifetime settings and evidence that session revocation works during incident response. Identity platforms can use continuous access evaluation to end sessions when risk changes. Remote access and privileged sessions deserve shorter limits than ordinary use.
Common gaps. Long-lived tokens and refresh tokens often survive password resets, so attackers keep access. Timeouts are set generously to reduce user friction and rarely revisited. Applications built in-house sometimes do not invalidate sessions on the server side at all.