End the session they still hold

Someone should no longer be signed in. A phone was lost, a teammate left, or a customer wrote and asked you to end the session they still have. Tonight, three things, in a console you administer. List that person's sessions, including when each one was issued. End those sessions at the service that accepts them, so the old secret is no longer a way in. Then prove a request that presents the old secret is refused, and prove a different person's session still succeeds. If the list, the ending, or either proof requires the person who built the product, you have not signed them out. You have sent a message asking someone else to.

This is one person's live session, on an account that still exists. It is not the spending cap on that account. Cap one account and leave the rest up is the refusal of the next request because a limit was crossed, while a different account still works. A session can be inside every limit and still be a session you were asked to end. It is not the deletion of the person. When a customer asks to be deleted removes what the live product can still show of them. Ending a session leaves the account, the invoices, and the files. Erasing the row to make the session disappear has answered a different email. It is also not the afternoon before a stranger can sign up, when you have to be able to erase a test account including its session. What to prove before public signup is that door. Tonight the person already has an account, and the account is supposed to remain.

A lock on the phone is a feeling people can report, and it is not a session your product issued. Pew Research Center's American Trends Panel, wave 127, was fielded 15–21 May 2023. Ipsos manages the panel. Interviews are web surveys in English and Spanish. Oversampled groups are weighted back to their share of the population. 5,101 U.S. adults responded out of 5,841 sampled, a response rate of 87%. The cumulative response rate, counting recruitment and attrition, is 3%. The margin of sampling error printed for that full sample of 5,101 is plus or minus 1.7 percentage points (Pew Research Center, methodology). Do not hang that 1.7 on a question that was not asked of all 5,101.

The question that matches a lost phone was asked only of smartphone owners. The topline prints the base as 4,801. The wording is: "Do you use a passcode, fingerprint, face recognition, or other security feature to unlock your smartphone?" 83% yes, 16% no, 1% no answer (Pew Research Center, wave 127 topline). 83, 16, and 1 add to 100. 83% is a share of the 4,801, not of the 5,101, and not of the people who use your product. 16% is a share who do not use a lock on the phone. It is not a share whose web session you failed to end, and it is not a share whose account was taken over. A different question on the same wave, about concern and control over personal data, is the one already quoted on who received their row. 83 is not that page's figure. The sample is U.S. adults in May 2023. It is not your users, and it is not a probability that the next email this week is a stolen phone.

The rule that describes a session, as distinct from the password that created it, is in a later document than the lock-screen survey. NIST Special Publication 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, July 2025, supersedes SP 800-63B of 2 March 2020. Section 5, Session Management, is normative. A session may be started after an authentication event and continue until it is terminated, including by an inactivity timeout or an explicit logout. The publication's reason for allowing a session at all is usability: continual presentation of credentials creates workarounds, such as caching an activation factor, which hides how fresh the authentication was (NIST, SP 800-63B-4, session management). You are not a federal agency, and nothing here finds that an authenticator assurance level applies to your company. The clocks below are the publication's, for agencies that document a system security plan. They are not a setting to paste into a startup because the paragraph contained a number.

Read the secret before you read the clock. A session secret shall be shared between the subscriber's software and the service. Continuity of the authenticated session shall be based on possession of a session secret that the session host issued at authentication. If that secret is a bearer token, the publication says it should not be persistent: it should not survive a restart of the application or a reboot of the device, because those events are supposed to end the session. Cookies and similar "remember my browser" features shall not be used instead of authentication, except for one reauthentication case at authenticator assurance level 2, when the inactivity limit has been exceeded and the overall time limit has not. Requirement 3 in the same list is easy to misread as an administrator's button. Secrets are erased or invalidated by the session subject when the subscriber logs out. The session subject is the browser or the application on their device. Erasing a cookie on a phone you do not hold is not an act you can perform. Invalidating the secret at the host, so the next presentation fails, is the act you can perform. The publication also says the secrets should be erased on the endpoint at logout, and should not be placed in insecure locations such as HTML5 local storage. A cookie's own expiry tag shall not be relied upon to enforce session timeouts. The tag is housekeeping. The host's refusal is the timeout.

The access token is a second object, and the publication separates it from presence. The relying party shall not interpret the presence of an access token as an indicator that the subscriber is still there, in the absence of other signals. The access token, and any associated refresh tokens, could be valid long after the authentication session has ended and the subscriber has left the application. A screen that says "signed out" while a refresh token still mints a new access token has ended a label. It has not ended the secret that gets a new label. The signup article's quote, from the authenticator-invalidation section of this same publication, is the removal of the binding between an authenticator and the account: loss, theft, compromise, or the account ceasing to exist. A stolen phone is on that list, and Table 3's theft examples include a cell phone. Invalidating the authenticator is that section. It does not, by the access-token sentence, guarantee that a session secret already issued is dead. Do both, and do not record one as the other.

The clocks are three rows, and they are not one policy with three names. Reauthentication shall be performed to confirm the subscriber's continued presence, the example being that they have not walked away without logging out. There are two timeouts. An overall timeout limits the session to a period after authentication or the previous reauthentication. An inactivity timeout ends a session with no activity for a period. When either expires, the session shall be terminated. Activity resets the inactivity timeout. A successful reauthentication resets both. At authenticator assurance level 1, a definite overall timeout shall be established and should be no more than 30 days. An inactivity timeout may be applied and is not required. At level 2, the overall timeout should be no more than 24 hours, and the inactivity timeout should be no more than 1 hour. At level 3, the overall timeout shall be no more than 12 hours, and the inactivity timeout should be no more than 15 minutes. Level 3's reauthentication is the same as its initial authentication. Level 2 may allow a password or a biometric together with the session secret, when inactivity has fired and the overall limit has not. 30 days is not 24 hours is not 12 hours. 1 hour is not 15 minutes. "Should" is not "shall." Level 1's 30 days is a should. Level 3's 12 hours is a shall. A session that has not yet hit its clock is still a session. The clock is not the customer's email, and it is not a substitute for ending the secret tonight.

Two further sentences keep a logout from being mistaken for a global one. Sessions should provide a readily accessible way for subscribers to log off when they are done. That mechanism is the subscriber's. It gives them control if the endpoint might be used by someone else. It is not a description of an administrator ending one subscriber's sessions while a different subscriber stays signed in. That second thing is the proof on this page, and the guideline does not perform it for you. Federation makes the same split across systems. The session at the identity provider and the session at your product are established and terminated independently. A new assertion can be minted from an identity-provider session that has not expired, without the subscriber authenticating again. Your product shall be the authority on whether its own reauthentication requirement was met. Ending the login at the provider does not end the session you issued. Ending the session you issued does not end a session at a second product. Write down which host you actually changed.

Do the three proofs in one sitting, on the live product, with two browsers that are not your admin session. First, the list. In a console you administer, name the person and every session the host will still accept for them: when it was issued, the client or device if you store one, and an identifier of the secret. Do not paste the secret into a chat in order to name it. A count with no identifiers is not a list. If the console cannot show sessions, write that, and stop claiming they are ended. Second, the ending. Invalidate those secrets at the host. Deleting a cookie on a laptop in the room is a demonstration of requirement 3, the subject erasing its copy. It is not a demonstration that a copy on the lost phone will fail. Third, the two requests. Present the old secret. The host refuses it. Present a different person's session, one you did not touch. That request succeeds. If the second request fails, you ended something wider than the person who wrote to you. If the first request succeeds, the button changed a screen and left the secret alive.

Three moves feel like the proof and are a second problem. Waiting for the 30-day or 24-hour or 12-hour clock, because the publication contained a number, while the phone is already gone. Asking a model to "log them out everywhere," which edits a prompt and leaves the session store. Invalidating every session in the tenant because the tool you were given has no single-person path. The first is a delay. The second is a fiction. The third is an outage for the people who did not write to you. Rotating a password without invalidating sessions already issued is the access-token sentence in operational clothes: the authenticator changed, and the refresh token did not. The credential a build minted, an API key rather than a person's session, is revoke the key they minted. A value still sitting in a commit, after the live secret was revoked, is name the secret the history holds. Neither of those is this list.

The path is ordinary when the product already separates an admin from a member. Gigbase is a multi-tenant workspace with subscription plans and role-based access for agencies, admins, and team members, and a dedicated admin dashboard. The shape that matters here is an admin, in an account you administer, who can see one person's sign-in and end it while another person still uses the product. That case is not a session ledger. Nothing in the description is a headcount, a duration, or a result figure. If the only control on the admin screen deletes the tenant, or turns the whole product off, you do not have this proof. You have a kill switch.

There is a version of this email where hiring the path is the wrong purchase. Nobody is signed in, because the product has no accounts yet. You have no product. You are still choosing who will build, and the document in front of you is a term sheet. The criteria for that choice sit on the page written for a top saas development company. That page is criteria. It does not rank anyone, including us. The only fact in the email is that their phone has a lock screen, and your product does not issue a session. The Pew figure is the lock. It is not a build. A customer has already seen another customer's data. Ending one session does not close a leak. Or you wanted a lawyer to say whether a guideline applies. Hire the lawyer.

When the request is real and the console cannot name a session, the missing object is specific. Ending the session does not name what the account was allowed to do while the secret was still good. That binding is name the role that account holds. An admin action, in an account you administer, that lists one person's sessions, ends those, refuses the old secret, and leaves a different person signed in. A startup software development company that expects this will have put that action next to the rest of account admin, before a lost phone is the way you discover you cannot. One that needs a call in order for you to end a session is telling you who holds the host. If the first slice is a fixed capability, an AI integration sprint is the shape where the acceptance sentence can include the three proofs. If you do not yet know which hosts issue sessions for the product you have, a two-week AI readiness assessment maps the systems. The findings are yours. They are not a promise that an assurance level applies, and they are not a rate.

Before you tell them they are signed out, do the three proofs and write the time. List the sessions. End them at the host that accepts the secret. Show the old secret fail, and show someone else still in. Do not wait for a clock you have not configured, and do not ask a model to remember a logout. The lock on their phone is how they protect a device. The refusal of the old secret is the page you can defend.