# Session And Device Management

Authenticated users can inspect their active browser sessions under **Settings
> Sessions and devices**. Each row exposes only a stable session identifier,
current-session marker, bounded user-agent label, creation time, last activity,
expiry, and lifecycle state. Session tokens, token and CSRF hashes, cookies, IP
addresses, and unrelated request metadata are never returned.

Users may revoke one other session or all other active sessions. The current
session is deliberately protected by these operations; use normal logout to end
it. Repeating a revocation is safe. Revoked sessions fail authentication on the
next request, including when a principal summary was previously cached.

Tenant administrators may list sessions only for a membership in their governed
tenant and may revoke only a session belonging to that membership and tenant.
The mutation requires both the central membership-update permission and an
interactive-session password re-authorization. API-key administration and
cross-tenant session disclosure fail closed.

Audit events retain the actor, target session or account, action, and revoked
count where applicable. They do not copy client labels, network addresses, or
credentials. Expired and revoked sessions are retained according to Access data
retention and are omitted from the active-session list.