APL least-privilege sessions after password expiry: diagnosing when access actually ends

Least-privilege access in APL is commonly expressed through individual accounts listed by ⎕USERS, with each account's password supplied through ⎕PW. Expiry is governed by ⎕PWEXPIRE, after which authentication attempts using the old password are expected to be rejected.

The unresolved point is session scope. It is not clear from the documented behavior whether an expiry event invalidates sessions that are already authenticated, or whether the credential remains usable until the next login. The distinction matters when a long-running APL process holds privileges that a policy intends to revoke.

Two constraints complicate a definitive answer: expiry semantics may vary by Dyalog APL release, and ⎕USERS handling is not identical across distributions. External directories such as LDAP are not natively integrated, so any bridge sits outside the interpreter's own checks. Verification should therefore start with the language reference for the installed version, then a controlled test using a non-zero expiry value.

• Does ⎕PWEXPIRE terminate an existing authenticated session, or only block subsequent logins?
• Which release-specific documentation defines the boundary between credential expiry and session lifetime?
• What least-privilege posture is intended for sessions that outlive their credentials?