Password Expiration Behavior in Dyalog APL Server: Does an Expired Credential Immediately Block Active Sessions?

In Dyalog APL Server (DAS) 22.12, administrators can enforce password expiration via the PasswordPolicy section of server.cfg. The documentation states that expired passwords prevent new logins, but it does not specify what happens to sessions that are already established when the expiry date passes. This ambiguity is critical for least‑privilege security models, where an account should not retain access after its credential has expired.

Because DAS currently lacks a documented automatic revocation mechanism for active sessions tied to expired credentials, it is unclear whether a user who logs in before expiry can continue using an existing session until the next request or until the session is explicitly terminated.

Key questions remain:

• Does an expired password immediately invalidate all active sessions, or do they persist until the next request?
• Is there an event logged when a session is terminated due to credential expiry?
• Can administrators configure DAS to automatically revoke active sessions when a password expires?