What changes when authority expires?
GS models admission, refresh, revocation and retained state. A restored session must still satisfy the current authority context.
Implementation & contract
GS session control and NativeStore own their transitions and retained state; GLAP consumes its selected admission context.
Identity, authority epoch, freshness and replay are explicit parts of the selected profile. Local operator enrollment is not a remote login service.
Inspect the existing mechanism
Inspect session authority and its lifecycle. Select the identity source and store profile for refresh, revocation and reopen tests.
Where to read the result & proof
Follow the authority contract and retained state. The selected GS evaluation binds its transition, refusal and reopen evidence.
Who uses this?
An IAM or security engineer specifies what must be rejected after expiry, revocation or restoration.