Identities
A person, an app, an agent, a server, a sandbox, and a workload that signed in through a trusted issuer are all connections. A session is a short-lived credential on a connection. What any of them can do is its grant, capped by every parent above it. The connection page shows two clocks: when the connection itself expires, and when access ends. Access ends at effectiveExpiresAt, the earliest of the connection, its ancestors, the access credential, and a browser sign-in. The page warns during the last 15 minutes. After a clock lapses, the next request names what expired and the next step.
Only a signed-in person can invite someone or trust an issuer.