kSecAttrAccessControl vs kSecAttrAccessible for biometric least-privilege

When implementing least-privilege authentication for sensitive credentials in Objective-C, developers must choose between granular access control and device-state protection levels.

The kSecAttrAccessControl attribute allows for specific biometric requirements, such as FaceID or TouchID, ensuring that the item is only released upon active user verification. In contrast, kSecAttrAccessible defines broader protection based on the device lock state, such as kSecAttrAccessibleAfterFirstUnlock, which may allow access to credentials as long as the device remains unlocked.

A specific challenge arises when managing the lifecycle of these items. While kSecAttrExpirationDate can be used to timestamp validity, the Security framework does not automatically purge items or block access based on this date during a SecItemCopyMatching call.

• Does kSecAttrAccessControl provide a mechanism to enforce expiration internally, or is manual date verification required regardless of the access control flag?
• In a least-privilege architecture, does combining biometric prompts with device-state attributes provide redundant security or conflicting access behaviors?