SQLAlchemy QueuePool and expiring database credentials: authentication check at checkout

Design goal is to use SQLAlchemy Engine with least-privilege, short-lived database credentials while reusing connections via QueuePool.

Credentials are supplied to the Engine URL and passed through to the DBAPI driver. When a credential expires, connections already checked into the pool may become unusable for subsequent checkouts. pool_pre_ping is documented for connection health testing before checkout.

The boundary between SQLAlchemy pooling logic and driver-level authentication is unclear for server-side invalidation that occurs during an idle period or inside a long-running transaction.

Does pool_pre_ping reliably surface authentication expiry before a connection is handed to application code, and is a new DBAPI connection created with refreshed credentials on failure? Under what conditions does the pool retain a connection whose authentication state has been revoked by the database server?