Credential Lifetime and Rotation

A 24-hour token on a 90-second pod: why quarterly identity reviews cannot reach it

Inventory and cadence cannot govern a credential whose holder is already deleted. The arithmetic points at one control: the lifetime written into the token when it is issued.