Sessions expire after inactivity. All actions are audit-logged.