Idle duration, absolute session lifetime and transaction approval are different time limits. Choose them for the use case.
Evaluation approach
Align server policy with local locking. Define background and network-outage behavior.
Application example
After a long absence, do not reveal an old document before required reauthentication.
Limits and considerations
Closing the local screen does not revoke a server token.
Does background time count as inactivity?
Define the policy consistently. Background tasks should not automatically count as user interaction. Verify that resumed screens and server sessions do not imply conflicting assurance.
Checks and decisions
- Separate time limits
- Test background use
- Verify server state
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.