# Identities

A person, an app, an agent, a server, a sandbox, and a workload that signed in through a trusted issuer are all connections. A session is a short-lived credential on a connection. What any of them can do is its [grant](/docs/concepts/grants/), capped by every parent above it. The connection page shows two clocks: when the connection itself expires, and when access ends. Access ends at `effectiveExpiresAt`, the earliest of the connection, its ancestors, the access credential, and a browser sign-in. The page warns during the last 15 minutes. After a clock lapses, the next request names what expired and the next step.

Only a signed-in person can invite someone or [trust an issuer](/docs/guides/workload-identity/).