PasswordAuthenticator and external identity stores: enforcing credential expiration Cassandra does not provide natively

We run Apache Cassandra (4.x) with PasswordAuthenticator and CassandraAuthorizer enabled, with roles granted least-privilege permissions on specific keyspaces and tables. The security policy for our environment requires passwords to expire after 90 days and accounts to lock after repeated failed logins.

From the documentation and our reading of the configuration surface, Cassandra hashes role passwords in the system_auth keyspace but appears to offer no native password-expiration, rotation, or lockout mechanism. We also understand that credential and permission caches (credentials_validity_in_ms, permissions_validity_in_ms) mean a revoked or rotated password may remain accepted until the cache expires, which complicates any external enforcement we build on top.

Our uncertainty is at the integration boundary: how to layer an external identity or rotation process onto Cassandra's role system without either breaking application connectivity during rotation or leaving stale credentials valid for the cache window.

Is there a documented or commonly accepted pattern for enforcing password expiration against PasswordAuthenticator, or is the intended approach to delegate authentication to LDAP where the distribution supports it? Should credentials_validity_in_ms be lowered (or set to zero) during rotation windows, and what latency impact should we expect? Finally, is there any way to make Cassandra reject a credential immediately after an external rotation, short of restarting nodes?