# Session Management

Record: `arch:session-management`
Kind: mechanism
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory for sensitive systems
Scope: service, authentication, security
Canonical: https://banes-lab.com/ontology#arch-session-management

## Repair

- Refactored by: Introduce Server-Side Session Management
- Detected by: no expiry/rotation/revocation on sessions
- Violated by: client-supplied identity trusted without server-side session
- Measured by: unbounded-session count
- Enforced by: security review

## requires

- [Authentication](https://banes-lab.com/records/arch/authentication.md)

## reinforces

- [Access Control](https://banes-lab.com/records/arch/access-control.md)
- [Least Privilege](https://banes-lab.com/records/arch/least-privilege.md)

## enables

- [Bounded Session Lifetime](https://banes-lab.com/records/lex/bounded-session-lifetime.md)
- [Revocable Access](https://banes-lab.com/records/lex/revocable-access.md)

## conflicts-with

- [Immortal Client-Trusted Session](https://banes-lab.com/records/lex/immortal-client-trusted-session.md)

## tensions-with

- [User Convenience](https://banes-lab.com/records/lex/user-convenience.md)

## tensions

- [Session Management User Convenience](https://banes-lab.com/records/tension/session-management-user-convenience.md)