Scope: session expiry + sliding refresh; a way to revoke all sessions (store a token version on the user, or session records). Used by password reset + account security.
Done when: sessions expire, refresh works, and "log out all devices" invalidates every session.