Limits of automatic session invalidation for expired credentials in CodeIgniter 4 Shield

When a user's password is marked as expired in the CodeIgniter 4 Shield authentication module, the login attempt fails unless the application explicitly checks the expiration flag and prompts a reset. However, any existing authenticated session remains active, allowing continued access until the session naturally expires or is manually destroyed. This behavior leaves a gap in least‑privilege enforcement because privileged sessions are not automatically revoked when credentials become stale.

What configuration or extension point should Shield provide to automatically invalidate sessions on password expiration? How can developers implement session invalidation without disrupting legitimate user workflows? What security trade‑offs arise from retaining sessions after credential expiration?