Slack token rotation limits: user token expiry behavior without bot token rotation
When a granular-permission Slack app opts into token rotation, the documented behavior introduces short-lived user access tokens paired with refresh tokens, while bot tokens reportedly remain non-expiring until uninstall or workspace reset. This asymmetry creates an unresolved design boundary: an app may need to bound user-token lifetime for least-privilege