Scoped access by role · sessions time out after inactivity